AWS NAT Gateway Cost: You Pay by the Hour and by the GB

An AWS NAT gateway costs $0.045 an hour in US East, about $32.85 a month just for existing, plus $0.045 for every gigabyte that passes through it. That’s the whole price list. The trouble is that both numbers multiply quietly: the hourly one by how many gateways your infrastructure code created, and the per-GB one by traffic that never needed to go through a NAT gateway in the first place.

Prices are from Amazon VPC pricing and the AWS Price List for US East (N. Virginia), published October 28, 2026. Partial hours are billed as full hours, and normal EC2 data transfer charges apply on top.

How many gateways do you actually have?

Fewer people know this number than you’d think. If you built the VPC with AWS CDK and didn’t set natGateways, the CDK Vpc construct creates one NAT gateway per Availability Zone. Three AZs, three gateways, $98.55 a month before a single byte moves. Copy the stack for staging and it’s $197.10.

The newer Regional NAT gateway doesn’t change this. It is billed $0.045 an hour for each AZ it’s running in, so a regional gateway across three AZs costs the same as three zonal ones.

A worked example

A hypothetical startup on ECS in US East, three AZs, CDK defaults, with a staging copy of production:

• Production: 3 gateways, 1,500 GB a month to and from S3, 500 GB of container image pulls from ECR, 200 GB to outside APIs (Stripe, an email provider, the usual).
• Staging: 3 gateways, about 100 GB a month, most of it S3 and ECR.

The NAT lines on that bill:

Line	Usage	Cost
Production gateway hours	3 × 730 h × $0.045	$98.55
Production data processed	2,200 GB × $0.045	$99.00
Staging gateway hours	3 × 730 h × $0.045	$98.55
Staging data processed	100 GB × $0.045	$4.50
Total		$300.60

The S3 traffic is the strange part. Data moving between EC2 and S3 in the same region is free, AWS’s own pricing example says so, but routed through a NAT gateway it still pays the $0.045 processing charge. You’re paying for a free transfer.

Fix one: the S3 gateway endpoint (free)

A gateway endpoint for S3 adds a route so S3 traffic leaves the private subnets without touching the NAT gateway, and there’s no charge for it at all. DynamoDB has the same kind of endpoint.

It catches more than you’d expect. ECR’s own docs explain that image layers are stored in S3: the container asks ECR for the manifest, then downloads the layers from S3. So the 500 GB of image pulls mostly move to the free endpoint too. In the example that takes 2,000 GB out of production’s NAT traffic and about 80 GB out of staging’s, which is $93.60 a month.

Two catches. A gateway endpoint only covers buckets in the same region, so a bucket in us-west-2 still goes through the NAT gateway. And adding it can briefly interrupt connections to S3 that are already open, so do it outside a deploy.

Fix two: one gateway in staging

Staging doesn’t need to survive an AZ outage. Set natGateways: 1 and two gateways go away: $65.70 a month. The other AZs now reach the internet through the one gateway, and that cross-AZ traffic is billed at $0.01 per GB in each direction. With staging’s remaining 20 GB, that’s cents.

Production is a judgment call. With one gateway, losing that AZ means the other two lose outbound internet. For a product with paying customers we’d keep one per AZ. For a pre-launch app in one region, one gateway is a reasonable trade, and we wouldn’t argue with someone who made it.

After both fixes the example is down to $141.30 a month, from $300.60, with nothing changed in the application.

Interface endpoints: check the maths first

The next suggestion people make is interface endpoints for everything else (CloudWatch Logs, SQS, Secrets Manager, ECR’s API). They are not free. PrivateLink pricing in US East is $0.01 an hour per endpoint per AZ, $21.90 a month for one endpoint across three AZs, plus $0.01 per GB.

That saves $0.035 per GB against the NAT gateway, so one endpoint in three AZs pays for itself only above roughly 626 GB a month through it. Most services don’t come close. A team shipping 40 GB of logs a month through a CloudWatch Logs endpoint pays more than it did before.

Finding your own numbers

In Cost Explorer, group by usage type and look for NatGateway-Hours and NatGateway-Bytes (in US East N. Virginia; other regions carry a prefix, like USE2-NatGateway-Bytes in Ohio). Divide the hours line by 730 and you have the number of gateways you’re paying for, which is often a surprise.

The bytes line tells you how much, not what. For that, the NAT gateway’s CloudWatch metrics (BytesOutToDestination, BytesInFromDestination) show which gateway carries the traffic, and VPC Flow Logs on its network interface show where it goes. When most of the destinations are S3 address ranges, fix one is your answer.

If the NAT lines are only part of a bill that grew, our free cloud cost audit reads the whole thing and tells you what we’d cut first. We also reduce startup AWS bills as a service, $0 up front and paid from the saving. The S3 side of the same bill is in what 1 TB of S3 really costs.