Articles
NAT Gateway: the bill line nobody looks at
Four and a half cents an hour is not a number that triggers a meeting. Across six environments it became one of the larger lines on the bill — and most of the traffic it processed never left AWS.
Two charges, not one
A NAT Gateway has two separate prices, and most people only know the first:
- For existing — about $0.045 per hour, roughly $33 a month per gateway.
- For every GB processed — another ~$0.045 per GB in us-east-1 (check your own region).
The second one is the surprise. It applies to traffic that never leaves AWS at all: a private subnet pulling ECR image layers, reading from S3, or calling Secrets Manager all passes through the gateway and is metered.
Three levers, in order
1. Gateway endpoints for S3 and DynamoDB — free
The biggest and cheapest win available: no hourly charge, no data processing charge. Technically it is a route table entry. If you have S3 traffic going through NAT, this is the first thing to do, before anything else.
2. Interface endpoints — only above a threshold
They cost about $0.01 per hour per availability zone (~$7.30 a month) plus about $0.01 per GB. Against NAT's $0.045 per GB the saving is roughly $0.035 per GB, which puts the break-even at about210 GB per AZ per month. Below that, the endpoint simply adds cost.
3. Cross-AZ traffic
A workload in one availability zone using a gateway in another pays both NAT processing and cross-AZ transfer. The fix is to keep resources in the same AZ as the gateway, or run one gateway per AZ — but per-AZ gateways multiply the hourly charge. It is a volume decision, not a fixed rule.
How to break the line down
One gateway for a full month is about $33 in hourly charges, plus about $3.65 for its public IPv4 address. Four gateways: about $131 in hourly charges plus about $15 for addresses — roughly $146 before a single GB of data.
Everything beyond that is data processing. Divide the remainder by $0.045 for a rough estimate of how many GB went through.
In Cost Explorer, group by usage type and filter for NatGateway. The split betweenNatGateway-Hours and NatGateway-Bytes tells you which problem you have: too many gateways, or too much traffic going through them.
Where it hurts most: non-production
In production I pay for managed availability without arguing. But in a development account nobody touches after 18:00, gateways in every availability zone buy availability nobody consumes. Multiply that across environments and you have an entire bill line created without anyone deciding on it.
What to do tomorrow morning
- 1Open Cost Explorer and filter for NatGateway. Check the ratio of hours to bytes.
- 2Add gateway endpoints for S3 and DynamoDB. Free, and it removes volume immediately.
- 3Do the 210 GB arithmetic per service before adding an interface endpoint.
- 4Check cross-AZ routing — traffic crossing a zone pays twice.
- 5Question non-production — does development really need a gateway per zone?
A shorter version first appearedon LinkedIn. Prices follow the AWS US pricing list at the time of writing — check your own region.
Keep reading
- Cloud cost optimization — a full optimization round.
- ECS or EKS — another decision that lands straight on the bill.
- AWS cloud services in Israel — network design done right from the start.
Want the same for your cloud?
A short call, then a written plan with a cost estimate and a fixed scope. No obligation.