NAT Gateway is one of the most common "why is this so expensive?" line items on an AWS bill. The hourly fee is the small part — it's the per-gigabyte data processing charge that quietly adds up. Here's how the pricing works and the practical ways to reduce it.
How AWS NAT Gateway pricing works
A NAT Gateway lets resources in a private subnet reach the internet (for updates, API calls, package downloads) without a public IP. You pay in two ways:
- An hourly charge for each NAT Gateway, billed whether it's busy or idle.
- A data processing charge per GB for every gigabyte that flows through it.
In multi-AZ setups it's common to run one NAT Gateway per Availability Zone, so the hourly fees multiply. But on high-traffic accounts, the data processing charge is usually the bigger cost — and it stacks on top of normal data transfer fees.
How to cut NAT Gateway costs
1. Add VPC Gateway Endpoints for S3 and DynamoDB
Gateway Endpoints for S3 and DynamoDB are free and route that traffic privately, bypassing the NAT Gateway entirely. If your workloads read or write a lot to S3 or DynamoDB from private subnets, this alone can remove a large chunk of data processing charges. This is usually the highest-impact fix.
2. Use Interface Endpoints for other AWS services
For services like ECR, Secrets Manager, SSM, and CloudWatch, Interface Endpoints (PrivateLink) keep traffic on the AWS network. They carry their own hourly + per-GB cost, so they pay off when the service traffic is heavy enough to beat the NAT processing fee.
3. Consolidate NAT Gateways
Running one NAT Gateway per AZ maximizes availability but multiplies the hourly fee. For non-production environments, a single NAT Gateway (accepting the cross-AZ trade-off) often cuts the fixed cost without any real risk.
4. Watch cross-AZ traffic
Routing private-subnet traffic to a NAT Gateway in a different AZ adds inter-AZ data transfer charges on top of the NAT fees. Keep the NAT Gateway in the same AZ as the workloads that use it.
5. Question whether you need a NAT Gateway at all
Some private workloads only talk to AWS services — with the right endpoints in place, they may not need internet egress at all. Fewer NAT Gateways means fewer hourly and per-GB charges.
See your NAT & data-transfer costs itemized
The AWS Billing Optimizer flags high NAT Gateway and data-transfer spend and the endpoints that would reduce it — read-only, free to start.
Scan my AWS account →Related: How to cut your AWS bill · Reserved Instances vs Savings Plans · AWS cost optimization FAQ