AWS cost · NAT gateway
Why your AWS NAT gateway is so expensive - and how to cut it
The NAT gateway is the line on an AWS bill that surprises people most. The advertised rate looks tiny - $0.045/GB - so nobody expects it to matter. Then the monthly total lands in the hundreds and nobody can say why. The reason is that the charges quietly stack, and most of what the gateway is processing never needed to go through it in the first place.
A NAT gateway costs about $33/month just to exist, then $0.045 for every GB it processes - and if that GB leaves AWS, another $0.09 of egress stacks on top. Most of the processed traffic is AWS-to-AWS calls to S3, DynamoDB, and ECR that never needed NAT. Route those through Gateway VPC endpoints and their processing charge drops to $0.
Where does the NAT gateway cost actually come from?
A NAT gateway bill is built from four separate charges (us-east-1 list pricing):
| Charge | Rate | What triggers it |
|---|---|---|
| NAT gateway, just running | ~$0.045/hr | ~$33/month per gateway |
| Data processing | $0.045/GB | every GB that passes through |
| Internet egress | +$0.09/GB | stacks on processing when the byte leaves AWS |
| Cross-AZ hop | +$0.01/GB | if the gateway is in another AZ |
The trap is the stacking. A single gigabyte that exits your VPC through the gateway and leaves AWS costs $0.045 + $0.09 = $0.135 - three times what the processing line alone suggests. Read the $0.045 rate and the bill still looks small. It is not.
Is the AWS internet gateway free?
Yes. An internet gateway has no meter at all - AWS publishes no hourly rate and no per-GB rate for one, and it is not a billable product in the price list, which is why it never appears as its own line on a bill.
What you pay is the data leaving AWS. Out of us-east-1 that is $0.09/GB for the first 10 TB each month, then $0.085/GB to 50 TB, $0.07/GB to 150 TB, and $0.05/GB above that. You pay that egress whether the traffic goes through an internet gateway or a NAT gateway.
That is the whole difference between the two. A NAT gateway adds $0.045/hr to exist and $0.045/GB to process, on top of the same egress. An internet gateway adds neither.
The catch is that they are not interchangeable. Reaching an internet gateway directly means the instance sits in a public subnet with a public IPv4 address, which bills at $0.005/hr - about $3.65/month per address and puts the instance on the public internet. That is a security decision before it is a cost one. NAT exists so private instances can reach out without being reachable, and for most workloads that is worth the $33/month.
Do VPCs cost money?
The VPC itself does not, and neither do subnets, route tables, security groups, or network ACLs. None of them has a billable meter. You can run a hundred of them and the VPC line on your bill stays at zero.
The charges come from what you put inside it, and there are only four worth watching: NAT gateways, at $0.045/hr plus $0.045/GB; interface endpoints, at about $7.30/month per Availability Zone; traffic between Availability Zones; and data leaving AWS. A surprising VPC bill is almost always the first of those.
Why is so much traffic going through the NAT gateway?
The single biggest source of unnecessary NAT cost is AWS-to-AWS traffic that does not need to touch the internet at all. From a private subnet, calls to S3, DynamoDB, ECR image pulls, and CloudWatch log pushes all route through the NAT gateway by default, and every byte is charged at the full processing rate. Nobody chose to send S3 traffic through NAT. It is just the default path when no endpoint exists.
How do I cut NAT gateway costs?
Start with Gateway VPC endpoints for S3 and DynamoDB. They have no hourly fee and no data processing charge, so traffic to those services stops touching NAT entirely. For an account routing 5 TB/month to S3, that is roughly $225/month in processing fees removed with zero application changes. For other AWS services you need an interface endpoint, which is not free - about $7.30/month per Availability Zone in us-east-1, so it only pays for itself above roughly 208 GB/month per AZ. And keep the gateway in the same Availability Zone as the instances that use it, so you do not pay the cross-AZ hop on top.
Creating the S3 Gateway endpoint is one command - point it at your VPC and route tables and S3 traffic stops touching NAT:
# free Gateway endpoint - S3 traffic bypasses the NAT gateway
aws ec2 create-vpc-endpoint \
--vpc-id vpc-xxxxxxxx \
--service-name com.amazonaws.us-east-1.s3 \
--route-table-ids rtb-xxxxxxxxShould I remove the NAT gateway entirely?
Only if nothing in the subnet needs the public internet. Once you have added VPC endpoints for the AWS services your workload calls, a private subnet that never reaches out to the internet does not need a NAT gateway at all - and you save the ~$33/month base charge as well as the processing. If some traffic genuinely goes to the internet, keep the gateway, but make sure it is only carrying the traffic that truly needs it.
Not sure how much of your NAT bill is avoidable? Connect your account read-only and see what it is wasting, in real dollars.
The role can only read - Get, Describe, List, nothing else. Read every permission it asks for before you connect, and delete the stack whenever you want. The scan adds about $0.10 to your own bill.
Frequently asked questions
Why is my NAT gateway so expensive?
+
Two reasons. The charges compound - $0.045/GB processing plus $0.09/GB egress means a gigabyte leaving AWS costs about $0.135, three times the processing line alone. And most of the traffic is AWS-to-AWS calls (S3, DynamoDB, ECR, CloudWatch) that route through NAT by default but never needed it.
How much does an AWS NAT gateway cost per month?
+
About $33/month just to keep one running (~$0.045/hour), before any traffic. On top of that you pay $0.045 for every GB processed, and another $0.09/GB if that data leaves AWS to the internet.
What is the difference between NAT gateway processing and data transfer charges?
+
Processing ($0.045/GB) is charged on every byte that passes through the gateway, no matter where it goes. Data transfer (egress, $0.09/GB) is charged separately when that byte leaves AWS. They stack, so internet-bound traffic pays both.
How do VPC endpoints reduce NAT gateway costs?
+
A Gateway VPC endpoint for S3 or DynamoDB routes that traffic directly out of your VPC with no hourly fee and no data processing charge. Traffic that used to pay $0.045/GB through NAT now pays $0. For an account pushing terabytes to S3, that is hundreds of dollars a month removed with no code change.
Do S3 and DynamoDB requests go through the NAT gateway?
+
By default, yes - from a private subnet, S3 and DynamoDB API calls route through the NAT gateway and get charged at the full processing rate. Add a Gateway VPC endpoint for each and that traffic bypasses NAT entirely, for free.
Is the AWS internet gateway free?
+
Yes. An internet gateway has no hourly charge and no per-GB charge - it is not a billable product at all, so it never appears as its own line on a bill. What you pay is the data leaving AWS: $0.09/GB for the first 10 TB a month out of us-east-1, tiering down to $0.05/GB above 150 TB. That egress is charged whether the traffic leaves through an internet gateway or a NAT gateway. The difference is that NAT adds $0.045/hour and $0.045/GB on top, and the internet gateway adds nothing.
Do VPCs cost money?
+
The VPC itself is free, as are subnets, route tables, security groups, and network ACLs - none of them has a billable meter. The cost comes from what runs inside: NAT gateways at $0.045/hour plus $0.045/GB, interface endpoints at about $7.30/month per Availability Zone in us-east-1, traffic between Availability Zones at $0.01/GB each way, and data leaving AWS at $0.09/GB. An unexpected VPC bill is almost always the NAT gateway.
Is a NAT instance cheaper than a NAT gateway?
+
A self-managed NAT instance on a small EC2 can be cheaper for low, steady traffic, but you take on patching, failover, and a bandwidth ceiling. For most teams, the bigger win is cutting the traffic through NAT with VPC endpoints rather than swapping the gateway for an instance.
Can I run a private subnet without a NAT gateway?
+
Yes, if nothing in the subnet needs to reach the public internet. Add VPC endpoints for the AWS services it does call (S3, DynamoDB, ECR, CloudWatch, and so on) and you can drop the NAT gateway completely for that subnet. Price it first: S3 and DynamoDB have free Gateway endpoints, but every other service needs an interface endpoint at about $7.30/month per Availability Zone in us-east-1, so a handful of them across three AZs can cost more than the gateway you removed. Check the type on the S3 one too - it also comes in a paid interface version.
Related cost breakdowns
Why your AWS data transfer bill is so high - and how to cut it
Data transfer hides across three charges: $0.09/GB out to the internet, $0.045/GB through a NAT gateway, and $0.01/GB each way between AZs. Here is where it comes from and how to cut it.
Cross-AZ data transfer: the $0.01/GB charge draining HA setups
Traffic between Availability Zones costs $0.01/GB each way - $0.02 round trip. A chatty multi-AZ setup can quietly run $1,000+/month. Here is how to find it and cut it.
Idle load balancers cost ~$16/month each - even with zero traffic
An ALB or NLB with no traffic still bills about $16 to $22/month just to exist. Here is how to find load balancers with no healthy targets and shut them down.
Why AWS is charging you for public IPv4 addresses
Since February 2024 every public IPv4 address costs $0.005/hour (~$3.60/month), attached or idle. Idle Elastic IPs are pure waste. Here is how to find and release them.