Updated 21 Oct 2026 • 7 mins read
AWS NAT Gateway Cost: Why It Is So High, and How to Cut It
AWS NAT Gateway cost is $0.045 per hour plus $0.045 per GB processed, stacked on top of normal data transfer, and most of the bytes passing through it are traffic to AWS services that a free or cheap VPC endpoint would carry. This guide gives the cost table, the reasons bills grow, a worked US example, and the fixes.
A NAT Gateway costs $32.85 a month to exist, which is the number everyone budgets, and $0.045 for every gigabyte that passes through it, which is the number that makes it one of the fastest-growing lines on an AWS bill. The processing charge is small per byte and indiscriminate about what the byte is: a nightly backup to S3, a container image pulled from ECR, logs shipped to CloudWatch, packages fetched for a build, and a database replicating to another region all pay it, on top of whatever transfer charge the traffic already carries, whether or not it needed to leave the VPC at all. Most of it did not.
This guide gives the NAT Gateway cost table in US dollars, explains why the bill stacks the way it does, identifies the traffic that should never pass through a gateway, works through a realistic example, and sets out the fixes in order of impact. NAT is one of the six paths in our guide to AWS data transfer fees, and the one most often paid for nothing. Rates are from the official VPC pricing page.
The short answer: An AWS NAT Gateway in US East costs $0.045 per hour, about $32.85 a month per gateway, plus $0.045 per GB of data processed in either direction, and that processing charge is added on top of the normal data transfer charges: $0.09 per GB for internet egress, $0.01 per GB each way for traffic crossing Availability Zones to reach a gateway in another zone. NAT bills are high because most of the traffic through a gateway is to AWS services, S3, DynamoDB, ECR, CloudWatch, that a free gateway endpoint or a $0.01-per-GB interface endpoint would carry instead, and because one gateway serving three zones adds cross-AZ charges on every byte. The fixes: gateway endpoints for S3 and DynamoDB, interface endpoints for ECR and other high-volume services, one gateway per zone for production, IPv6 with an egress-only internet gateway where supported, and attributing the remaining NAT cost to the services behind it so someone owns the number.
The NAT Gateway Cost Table
US East (N. Virginia) list prices as of October 2026. Other regions run higher.
| Charge | Rate | Monthly at typical volume | Notes |
|---|---|---|---|
| NAT Gateway hourly | $0.045 per hour | $32.85 per gateway | Bills whether or not traffic flows; one per AZ in production |
| NAT data processing | $0.045 per GB, both directions | $45 per TB | Added to whatever transfer the traffic already pays |
| Internet egress through NAT | $0.09 per GB (first 10 TB, after 100 GB free) | $90 per TB | Stacks on processing: $0.135 per GB total |
| Cross-AZ to a gateway in another zone | $0.01 per GB each way | $20 per TB round trip | Avoided by one gateway per zone |
| Gateway VPC endpoint (S3, DynamoDB) | Free | $0 | Replaces NAT for these two services |
| Interface VPC endpoint (ECR, CloudWatch, others) | About $0.01 per hour per AZ plus $0.01 per GB | About $7.30 per endpoint per AZ plus $10 per TB | Replaces NAT for AWS APIs; keeps traffic on the AWS network |
| Egress-only internet gateway (IPv6) | Free | $0 | No hourly or processing charge; standard transfer applies |
| NAT instance (self-managed) | EC2 instance rate, e.g. t4g.small about $12 a month | $12 plus transfer | No processing charge; you operate it |
Why NAT Bills Grow
- AWS-service traffic through the gateway. S3 uploads and downloads, DynamoDB calls, ECR image pulls, CloudWatch log shipping, Systems Manager, and Secrets Manager all route through NAT by default from a private subnet unless an endpoint exists. This is usually the majority of NAT bytes, and all of it is avoidable.
- Container image pulls. A Kubernetes cluster pulling a 500 MB image across 60 nodes on every deploy moves 30 GB through NAT per deploy; ten deploys a day is $400 a month in processing for images that live in ECR, inside AWS.
- One gateway, three zones. A single gateway saves $66 a month in hourly charges and adds $0.02 per GB round trip on every byte from the other two zones, which exceeds the saving at a few terabytes.
- Backups and replication. Nightly database dumps to S3 and cross-region replication through NAT pay processing on every run, for traffic with a free path available.
- Non-production gateways. A NAT Gateway in each dev, test, and sandbox VPC bills $33 a month whether the VPC does anything, and estates routinely carry dozens.
- Nobody owns the line. AWS bills the gateway, not the service. Which subnet or application sent the bytes lives in VPC Flow Logs, so NAT cost lands as an unattributed networking line that no team sees as its own, which is why it grows: the pattern in our guide to where cloud waste hides.
A Worked Example
A production VPC runs application servers in three Availability Zones behind one NAT Gateway in zone A, plus an EKS cluster of 40 nodes. Monthly NAT traffic is about 9 TB: 4 TB of S3 reads and writes from the application and its backups, 2 TB of ECR image pulls, 1 TB of CloudWatch logs and other AWS API calls, and 2 TB of genuine internet traffic to third-party APIs. Two-thirds of the instances are in zones B and C.
The gateway costs $33 hourly plus $405 processing on 9 TB. Cross-AZ transfer from zones B and C, 6 TB round trip, adds $120. Internet egress on the 2 TB of third-party traffic adds $180. Total NAT-related cost: about $740 a month, of which only the $180 of egress and the processing on that 2 TB, about $90, is for traffic that needed a NAT Gateway at all.
A gateway endpoint for S3 removes $180 of processing at no cost. Interface endpoints for ECR and CloudWatch, about $44 a month in hourly charges across three zones plus $30 per TB, replace $135 of processing with about $74. A NAT Gateway in each zone adds $66 in hourly charges and removes the $120 of cross-AZ transfer. The line falls from about $740 to about $410 with the same traffic, and the $410 is now mostly the third-party egress that is the gateway's actual job. Routing that through fewer, batched calls or a CDN-cached API is the next step.
How to Cut NAT Gateway Cost, in Order
1. Add gateway endpoints for S3 and DynamoDB today
Free, a route-table change, no downside. For most VPCs this removes the largest share of NAT processing in an afternoon.
2. Add interface endpoints for high-volume AWS services
ECR (both the API and the Docker endpoint), CloudWatch Logs, Systems Manager, Secrets Manager, STS, and any service a private subnet calls heavily. At $0.01 per GB against $0.045, an endpoint pays for its hourly charge at a few hundred gigabytes a month.
3. One gateway per production zone
Remove the cross-AZ hop and the single point of failure. Keep one gateway for light non-production VPCs.
4. Use IPv6 where destinations support it
Dual-stack private subnets with an egress-only internet gateway reach IPv6 destinations with no NAT charge at all.
5. Move public-facing traffic off NAT
Anything serving the internet belongs behind a load balancer, not behind NAT. Outbound traffic to third-party APIs that cannot be avoided can often be batched or cached.
6. Delete gateways nobody uses
Audit every VPC for gateways with negligible processing; each is $33 a month plus its public IPv4 address.
7. Attribute what remains
Join NAT processing to the subnets and services that generated it so the remaining cost has an owner. A networking line that belongs to everyone is optimized by no one, which is the general rule in our guide to allocating cloud costs.
How Opslyft Does This
The NAT problem is an attribution problem before it is a routing problem: the fixes above are obvious once someone can see that 4 TB of a gateway's traffic is S3 reads from the data team's jobs, and invisible while the invoice says only that a gateway processed 9 TB. Explorer shows NAT hourly and processing charges beside the EC2, EKS, and S3 spend of the services and subnets behind them, by account, team, and service, tracked over time so a gateway whose processing doubled after a deploy is visible that week. Dimension Studio attributes a shared gateway's cost to the services behind it by usage-driven rules rather than leaving it as an unowned networking line, which is what puts the $405 of processing on the data team's and the platform team's numbers rather than on nobody's.
Atlas inventories every NAT Gateway, endpoint, and public address with an owner and a cost, flags gateways with negligible traffic and VPCs where endpoints are missing, and records the change behind a cost movement. Monitor catches a gateway whose processing jumped, a new backup job, a cluster pulling images on every pod restart, with the cause, routed to the owning team's Slack channel; Tickets turns the fix, usually an endpoint, into an assigned item in Jira, ServiceNow, or Asana tracked to a measured saving; and Iris answers which services drove NAT cost this month in plain English. The networking line stops being a mystery and becomes a set of owned items, the way Disprz turned 50 to 60 shared services into attributed cost.
The Bottom Line
NAT Gateway cost is high because the gateway charges for every byte regardless of where it is going, and most bytes through it are going somewhere a free or nearly free path already exists. Add the S3 and DynamoDB endpoints today, add interface endpoints for the services your private subnets call most, run a gateway per production zone, use IPv6 where you can, delete the gateways nobody uses, and attribute the rest to the services behind it. Then the NAT line shrinks to the job it was built for: letting private instances reach the internet when they genuinely need to. For the other paths that price the same byte six ways, see our AWS data transfer fees guide and, for the address charge every gateway carries, Elastic IP charges.
FAQs
In US East, a NAT Gateway costs $0.045 per hour, about $32.85 a month, plus $0.045 per GB of data it processes in either direction, plus the normal data transfer charges on top: internet egress at $0.09 per GB, or cross-AZ transfer when the gateway sits in a different zone from the instance using it. A gateway processing 5 TB a month costs about $33 hourly plus $225 processing plus about $450 egress, near $710.
Usually because traffic that never needed to leave the VPC is going through it. Private instances reaching S3, DynamoDB, ECR, CloudWatch, or other AWS services through a NAT Gateway pay $0.045 per GB processing for traffic a free gateway endpoint or a cheap interface endpoint would carry. Container image pulls, S3 backups, log shipping, and package installs are the usual culprits, and a single gateway in one zone serving instances in three adds cross-AZ charges on every byte.
For AWS services, always. Gateway endpoints for S3 and DynamoDB are free. Interface endpoints for other services cost about $0.01 per hour per Availability Zone plus $0.01 per GB, against NAT's $0.045 per GB, so at anything above a few hundred gigabytes a month per service the endpoint wins by a wide margin, and it keeps the traffic on the AWS network.
One per zone for production. A single gateway saves two hourly charges, about $66 a month, but every byte from instances in the other zones crosses a zone boundary at $0.01 per GB each way before it reaches the gateway, and the architecture has a single point of failure. For non-production with light traffic, one gateway is a reasonable saving.
Because AWS bills the gateway, not the traffic. The invoice shows processing bytes and hours per gateway; which subnet, instance, or service sent those bytes is in VPC Flow Logs, not in billing. Attributing NAT cost to the services behind it requires joining the two, which is why NAT is one of the most common unallocated lines on an AWS bill.
For IPv6 traffic, yes. An egress-only internet gateway lets IPv6-enabled private instances reach the internet with no hourly or per-GB gateway charge; standard data transfer rates still apply. For workloads and destinations that support IPv6, it removes the NAT line entirely, which is part of why AWS has been steering customers toward IPv6.
Opslyft shows NAT hourly and processing charges in Explorer beside the services, subnets, and accounts they serve, and Dimension Studio attributes a shared gateway's cost to the services behind it by usage-driven rules rather than leaving it as an unowned networking line. Atlas inventories every gateway with an owner, Monitor flags a gateway whose processing jumped with the cause, and Tickets routes the fix, usually a VPC endpoint, to the owning team.