The NAT Gateway trap: how $0.045 per gigabyte inflates your cloud bill

Published February 14, 2026

AWS documentation instructs teams to place backend workloads in private subnets and route outbound internet traffic through a managed NAT Gateway. It is simple to set up, scales automatically to 100 Gbps, and requires no maintenance.

It is also one of the most expensive data-plane components in cloud networking.

A single NAT Gateway charges two separate fees: an hourly provisioned charge and a per-gigabyte data processing fee. When paired with standard AWS Internet Data Transfer Egress (DTO), moving data out of a private subnet costs significantly more than teams anticipate.

Here is how NAT Gateway billing works, why internal AWS traffic gets caught in the meter, and three architectural changes that eliminate most of the cost.

The NAT Gateway billing model

According to AWS pricing data in our networking section, a standard NAT Gateway in us-east-1 has two billing dimensions:

1. Hourly provisioning fee: $0.045 per gateway hour.
2. Data processing fee: $0.045 per gigabyte processed (both ingress and egress traffic traversing the gateway).

Base hourly cost per gateway:
  $0.045/hr * 730 hrs = $32.85/month

Standard 3-AZ high-availability setup (1 NAT Gateway per AZ):
  3 * $32.85 = $98.55/month (idle, with 0 GB of traffic)

Before processing a single packet, a multi-AZ deployment costs ~$100 every month just to exist. Regional variations can push this higher: in São Paulo (sa-east-1), a NAT Gateway costs $0.093/hr and $0.093/GB, putting 3 idle gateways at $203.67/month.

The double-dip on public internet traffic

When a private EC2 instance downloads a container image from Docker Hub or sends an API payload to an external SaaS vendor, you pay twice for the same bytes:

• NAT Gateway processing fee: $0.045/GB
• Internet Data Transfer Egress (DTO): $0.090/GB (first 10 TB tier in us-east-1)

Total cost per gigabyte of internet egress:
  $0.045 (NAT processing) + $0.090 (Data transfer) = $0.135/GB ($135/TB)

For every terabyte of outbound internet traffic from a private subnet, the NAT processing fee adds a 50% surcharge on top of AWS’s standard data egress rate.

The silent trap: paying NAT fees on internal AWS traffic

The biggest billing surprises rarely come from public API traffic. They come from internal AWS services like S3 and DynamoDB.

By default, an EC2 instance in a private subnet communicates with regional AWS services over their public endpoints. When that subnet’s default route (0.0.0.0/0) points to a NAT Gateway:

1. The private instance initiates a connection to s3.us-east-1.amazonaws.com.
2. The packets route through the NAT Gateway.
3. The NAT Gateway translates the private IP to its public Elastic IP and forwards the request.
4. AWS bills $0.045/GB for NAT data processing.

Data transfer between EC2 and S3 within the same region is $0.00/GB. However, because traffic flowed through the NAT Gateway data plane, AWS meters the full payload at $0.045/GB.

If an overnight database backup dumps 10 TB of compressed snapshots directly to an S3 bucket in the same region, that single job generates $450 in NAT data processing fees for traffic that AWS would otherwise transfer for free.

Three architectural fixes to bypass the meter

1. Gateway VPC Endpoints for S3 and DynamoDB (100% free)

Gateway VPC Endpoints are route table entries that direct traffic destined for S3 or DynamoDB directly to the service over AWS’s internal private network, completely bypassing the NAT Gateway.

• Hourly cost: $0.00
• Data processing cost: $0.00/GB

Private Subnet Route Table:
Destination               Target
-----------------------   ----------------------
10.0.0.0/16               local
pl-63a5400a (com.amazonaws.us-east-1.s3) -> vpce-12345678 (Gateway Endpoint)
0.0.0.0/0                 nat-0123456789abcdef0 (NAT Gateway)

Adding a Gateway VPC Endpoint takes under two minutes in the VPC console or Terraform, requires no code changes or DNS updates, and instantly drops S3 and DynamoDB NAT processing costs to zero.

2. Interface VPC Endpoints (PrivateLink) for other AWS APIs

For AWS services that do not support Gateway Endpoints (such as ECR, CloudWatch Logs, Secrets Manager, SQS, and SSM), AWS offers Interface VPC Endpoints powered by PrivateLink.

Interface Endpoints place an Elastic Network Interface (ENI) with a private IP directly into your subnet.

• Hourly cost: $0.01 per AZ endpoint hour (~$7.30/month per AZ)
• Data processing cost: $0.01/GB

Comparing Interface Endpoints to NAT Gateways:

Because Interface Endpoints cost $0.01/GB instead of $0.045/GB, they offer a 78% discount on variable processing fees. If a microservice cluster in 3 AZs pushes high volumes of application logs to CloudWatch Logs or pulls gigabytes of container layers from ECR daily, Interface Endpoints pay for themselves immediately once service traffic exceeds ~210 GB per month.

3. Self-hosted NAT instances (fck-nat / iptables) on Graviton

If your workload pushes tens of terabytes of genuine outbound internet traffic (such as web crawling, third-party webhook dispatching, or external dataset scraping), VPC Endpoints cannot help because the destination is outside AWS.

For these workloads, replacing the managed NAT Gateway with an EC2-based NAT instance running standard Linux packet forwarding (iptables / nftables) eliminates the variable per-gigabyte processing fee entirely.

Open-source implementations like fck-nat package this pattern into an AMI with automated health checks and route table reattachment.

Looking at instances pricing:

• A t4g.nano (2 vCPUs, 0.5 GiB RAM, up to 5 Gbps burst network) costs $0.0042/hr ($3.07/month) in us-east-1.
• A 3-AZ deployment uses 3x t4g.nano instances totaling $9.20/month fixed, with $0.00 per-GB processing fees.
• For sustained high-throughput workloads requiring 10+ Gbps dedicated networking, a c7g.medium costs $0.0363/hr ($26.50/month per AZ), which is still cheaper than an idle NAT Gateway while processing unlimited gigabytes without surcharges.

The trade-off is operational ownership: your team is responsible for AMI updates, failover configuration across AZs, and monitoring interface drop counters.

Monthly cost comparison scenarios

The table below outlines monthly networking costs in us-east-1 across three outbound traffic tiers for a 3-AZ architecture.

Assumptions:

• Architecture: 3 Availability Zones.
• Internet Egress: Billed at standard DTO rate ($0.090/GB for first 10 TB, $0.085/GB for subsequent volume).
• S3 / Internal Traffic: 50% of total volume is internal AWS data transfer; 50% is public internet egress.

At 50 TB of combined monthly volume, routing S3 traffic through a free Gateway Endpoint saves $1,125/month. Swapping the remaining NAT Gateways for Graviton-based NAT instances saves another $1,214/month, cutting the monthly networking bill by over 50%.

Summary checklist

To audit and eliminate NAT Gateway waste in your AWS accounts:

1. Deploy S3 and DynamoDB Gateway Endpoints immediately: There is no ongoing cost or performance penalty. Ensure every VPC route table in every active region has entries for com.amazonaws.<region>.s3 and com.amazonaws.<region>.dynamodb.
2. Inspect VPC Flow Logs for top talkers: Filter by your NAT Gateway private ENI IP addresses to identify which destination endpoints generate the highest packet counts.
3. Evaluate Interface Endpoints for heavy AWS API usage: If ECR image pulls or CloudWatch metrics exceed 250 GB/month per AZ, configure PrivateLink interface endpoints.
4. Consider NAT instances for high-volume egress: For workloads pushing massive outbound traffic to external endpoints, deploy self-hosted Graviton instances using t4g.nano or c7g.medium to remove the $0.045/GB meter entirely.