The $0.045/GB NAT Gateway tax

Eliminates all NAT processing for S3/DynamoDB traffic

Gateway Endpoints are free and take minutes to configure. They route S3 and DynamoDB traffic over the AWS backbone, completely bypassing NAT Gateway. There is zero downside and zero cost. This should be the first thing you do in every VPC.

Identifies traffic that can be redirected

Enable VPC Flow Logs on your NAT Gateway ENI to see exactly what traffic is flowing through it. Common findings: S3 traffic that should be using Gateway Endpoints, AWS API calls that can use Interface Endpoints, and external monitoring agents that can use VPC endpoints instead.

$0.035/GB net savings per service (NAT $0.045 - Endpoint $0.01)

For AWS services you call frequently (CloudWatch, ECR, SQS, SNS, KMS), Interface Endpoints cost less than routing through NAT Gateway. Calculate break-even: the hourly cost of an Interface Endpoint (~$21.90/mo per AZ) is recovered if the service generates more than ~650GB/month of traffic.

Can remove cross-AZ transfer fees (not a fixed-cost saving)

Regional NAT Gateway (launched Nov 2025) lets one managed gateway auto-expand across the AZs where you have workloads, so you skip the per-AZ subnets and route-table edits. It does not reduce the hourly bill: AWS charges $0.045/hr per active AZ, so spanning 3 AZs costs the same as 3 zonal gateways. The genuine cost benefit is avoiding cross-AZ data transfer charges for NAT traffic, but only when the gateway is active in every AZ where you run workloads. The per-GB processing fee still applies.

100% NAT elimination for IPv6 traffic

IPv6 addresses are publicly routable, eliminating the need for NAT entirely. AWS supports dual-stack VPCs, ALBs, and most services. The main challenge is ensuring all clients support IPv6. For internal services and APIs, this provides immediate NAT cost savings with no per-GB charges.

~90% reduction for dev/staging environments

Development and staging environments rarely need the throughput or HA of managed NAT Gateway. A t3.nano NAT Instance costs $3.80/month with no per-GB fee. fck-nat is an open-source alternative that provides auto-healing via Auto Scaling Groups. Both save hundreds of dollars per month per environment.

How much does AWS NAT Gateway cost per month?

AWS NAT Gateway costs $0.045 per hour (approximately $32.85/month) plus $0.045 per GB of data processed. At 10TB/month, the total cost is approximately $483/month ($32.85 hourly + $450 processing). At 50TB/month, it is approximately $2,283/month. If traffic crosses AZ boundaries to reach the NAT Gateway, add another $0.01/GB. These charges are in addition to standard internet egress fees.

What is the difference between NAT Gateway and NAT Instance?

NAT Gateway is a managed AWS service that provides high availability and scales automatically up to 100 Gbps. NAT Instance is a self-managed EC2 instance running NAT software. NAT Gateway costs $0.045/GB + $0.045/hr, while a NAT Instance (t3.nano) costs approximately $3.80/month with no per-GB processing fee. NAT Instances are dramatically cheaper for low-to-medium traffic but require manual management, do not auto-scale, and have lower throughput limits.

Does Regional NAT Gateway reduce NAT Gateway costs?

Mostly no. Regional NAT Gateway, launched November 2025, lets a single NAT Gateway automatically expand across the Availability Zones where you have workloads, so you no longer create and route one gateway per AZ by hand. But it does not cut fixed costs: AWS bills it $0.045/hr per active AZ, so a regional gateway spanning 3 AZs costs the same as 3 zonal gateways. The real win is operational simplicity, plus a few dollars saved on Elastic IPs. It can avoid cross-AZ data transfer charges, but only if it is active in every AZ where you run workloads. If a workload sits in an AZ where the gateway is not yet active, its internet-bound traffic is routed to another AZ and incurs cross-AZ charges. The per-GB processing fee ($0.045/GB) still applies.

How can I eliminate NAT Gateway costs on AWS?

The most effective strategies are: enable VPC Gateway Endpoints for S3 and DynamoDB traffic (free, eliminates all NAT processing for these services); use Interface Endpoints for other AWS services like SQS, SNS, and CloudWatch; adopt IPv6 for internet-facing workloads (eliminates NAT entirely); and use fck-nat or NAT instances for development and staging environments where high availability is less critical.

Does NAT Gateway charge on top of internet egress fees?

Yes. NAT Gateway processing fees are entirely separate from and additive to internet egress charges. If you send 10GB through a NAT Gateway to the internet, you pay $0.045/GB NAT processing ($0.45) plus $0.09/GB internet egress ($0.90) for a total of $1.35. If the NAT Gateway is in a different AZ, add another $0.01/GB cross-AZ charge ($0.10). The effective cost of internet egress through a NAT Gateway is $0.135-0.145/GB, not the headline $0.09/GB.