Prasad Ekke

Cloud cost tool

AWS NAT Gateway Cost Estimator

NAT gateways charge for every GB they process, including traffic to S3, ECR, and other AWS services that never leaves the region. Estimate what yours cost each month, then see which fixes pay for themselves.

NAT cost today $0 $0 / year
With the fixes below $0 $0 / year
Saving $0 $0 / year

Your VPC

US East (N. Virginia) list prices, per month
Fewer than your AZs means some traffic crosses zones
Both directions. In Cost Explorer: NatGateway-Bytes
percent
Image layers, logs, backups, data lakes
percent
ECR API, CloudWatch, STS, SQS, Secrets Manager
To the internet 35% Whatever is left. Egress charges for it are separate.

Where the money goes today

Fixes

Each saving is measured on its own. The total above applies all the ticked fixes together.
$0

Gateway VPC endpoints have no hourly or per-GB charge. Add them to the route tables of your private subnets and S3 and DynamoDB traffic bypasses the NAT gateway entirely. This is almost always the biggest and easiest win.

$0
billed in every AZ at $0.01 / hour, plus $0.01 / GB

PrivateLink endpoints replace the $0.045 / GB NAT charge with $0.01 / GB, but each endpoint costs about $7.30 a month per AZ. Worth it for heavy traffic such as ECR image pulls or CloudWatch Logs, and not for services you call a few times a day.

$0
30%

An egress-only internet gateway has no hourly or processing charge. Internet traffic from dual-stack subnets to IPv6-capable destinations can skip the NAT gateway. Internet egress is still billed as usual.

$0

With one NAT gateway per AZ, and each private subnet routed to the NAT in its own zone, nothing pays the $0.01 / GB cross-AZ charge in each direction. With little traffic, as in a dev account, fewer gateways can be cheaper even with the cross-AZ charges.

Prices used
ItemPrice (USD)
NAT gateway, per hour$0.045
NAT gateway data processing, per GB$0.045
Public IPv4 address (the NAT gateway's Elastic IP), per hour$0.005
Cross-AZ data transfer, per GB in each direction$0.01
Gateway endpoint (S3, DynamoDB)Free
Interface endpoint, per hour per AZ$0.01
Interface endpoint data processing, per GB (first 1 PB)$0.01
Egress-only internet gatewayFree

US East (N. Virginia) list prices, checked October 2026 against the AWS Price List API and the Amazon VPC pricing page. A month is 730 hours. Traffic is assumed to be spread evenly across AZs, so with N gateways in M zones, (M−N)/M of NAT traffic crosses a zone. Internet egress ($0.09 / GB and down) applies whether or not traffic goes through a NAT gateway, so it is left out. Model it with the egress cost estimator.

Why NAT gateways cost more than you expect

The hourly charge is small: $0.045 an hour is about $33 a month per gateway. The expensive part is data processing, $0.045 for every GB that passes through, in either direction. A 1 GB container image pulled from ECR, a log batch shipped to CloudWatch, and a Parquet file read from S3 are all charged, even though none of that traffic leaves AWS. At 20 TB a month, processing alone is over $900.

Find out what goes through your NAT gateways

In Cost Explorer, filter on usage type NatGateway-Bytes to see the monthly volume. To see where it goes, turn on VPC Flow Logs for the NAT gateway's network interface and group the traffic by destination. Destinations in the S3 or DynamoDB prefix lists (com.amazonaws.us-east-1.s3) can use a free gateway endpoint. Addresses owned by other AWS services are candidates for interface endpoints.

Gateway endpoints first, interface endpoints where the traffic justifies them

A gateway endpoint for S3 is free, takes a route-table change, and works for most workloads straight away. Check bucket policies that rely on aws:SourceIp, because traffic through an endpoint arrives from private addresses. An interface endpoint breaks even against NAT processing at roughly 210 GB a month per AZ it is deployed in ($7.30 ÷ $0.035). Heavy ECR pulls clear that easily, and a rarely used API does not.

One NAT gateway per AZ, or fewer?

AWS recommends a NAT gateway in each AZ for resilience. If one fails, only its zone loses outbound access. That also avoids cross-AZ charges. For small, non-production VPCs a single gateway can be cheaper. Set the fix above to 1 and see where the break-even falls for your traffic.

Related

Compare storage classes with the S3 vs Google Cloud Storage cost calculator, or model internet, inter-region, and cross-AZ traffic across clouds with the cloud egress cost estimator.