Because it charges twice
Why is the AWS NAT Gateway so expensive?
NAT gateways are expensive for a structural reason: you pay to have one and you pay again for everything that goes through it, including traffic that never needed to leave AWS.
A NAT gateway costs $0.045 per hour just to exist, which is about $32.85 a month, plus $0.045 for every GB it processes. The per-GB charge is the part that hurts, because it applies to traffic going to S3, DynamoDB, ECR and other AWS services that never leaves the AWS network. A high-availability setup with one gateway per availability zone starts at roughly $99 a month before a single byte moves.
Where the money goes
| Component | Rate | Monthly cost |
|---|---|---|
| One NAT gateway, running | $0.045 / hour | $32.85 |
| Three NAT gateways, one per AZ | $0.045 / hour each | $98.55 |
| 100 GB processed | $0.045 / GB | $4.50 |
| 1 TB processed | $0.045 / GB | $46.08 |
| 10 TB processed | $0.045 / GB | $460.80 |
| Egress to internet, on top | from $0.09 / GB | charged separately |
Processing is charged on traffic in both directions. Internet egress is a separate line and stacks on top of the processing charge.
Three ways to cut it, cheapest first
- 1Add gateway VPC endpoints for S3 and DynamoDB. They are free. Not cheap, free. They route S3 and DynamoDB traffic straight out of the VPC without touching the NAT gateway, which removes both the processing charge and, in most accounts, the largest share of NAT traffic. In an account pulling container images and writing logs to S3 this is usually the single biggest network saving available.
- 2Check whether you need one gateway per availability zone. The one-per-AZ pattern exists so that an AZ failure does not take out egress for the surviving zones. That is correct for production. For dev and staging, a single gateway shared across AZs saves $65 a month per environment, at the cost of a resilience property nobody exercises in staging.
- 3Price interface endpoints against the traffic they carry. Interface endpoints for services like ECR, Secrets Manager and CloudWatch Logs cost about $7.30 per AZ per month plus $0.01 per GB. They only pay for themselves above roughly 160 GB a month of traffic to that service per AZ. Below that, the NAT gateway is genuinely cheaper. Do the arithmetic rather than adding endpoints everywhere.
The thing people try that does not work
Replacing the NAT gateway with a NAT instance on a t4g.nano looks compelling: about $3 a month instead of $33, and no per-GB charge. It is also a single point of failure you now maintain, patch and monitor, with a bandwidth ceiling tied to the instance size and no automatic recovery.
For a lab it is fine. For anything carrying production traffic, the $30 a month is buying a managed, redundant, autoscaling component, and the engineer hours spent debugging a saturated NAT instance at 2am cost considerably more than the saving.
Fix the traffic first. A NAT gateway carrying almost nothing costs $33 a month and is not worth an argument.
Put numbers on it
NAT Gateway cost calculator
Charged hourly and per GB, and a lot of that traffic could go over free VPC endpoints instead.
Open calculator →
Data transfer cost calculator
Egress, cross-AZ, inter-region and NAT processing priced separately. The one that gets you is rarely the one you were watching.
Open calculator →
Frequently asked questions
Do VPC gateway endpoints really cost nothing?
Gateway endpoints, which exist only for S3 and DynamoDB, are free with no hourly charge and no data processing charge. Interface endpoints, which cover most other AWS services, cost roughly $0.01 per hour per availability zone plus $0.01 per GB. The two are frequently confused and the pricing is completely different.
Is a NAT gateway needed at all?
Only for resources in private subnets that need outbound internet access, for package installs, API calls to third parties or container image pulls. Workloads that only talk to AWS services can often run with VPC endpoints and no NAT gateway at all. Anything in a public subnet with a public IP does not use one.
Why is my NAT processing charge higher than my internet egress?
Because processing is charged on traffic in both directions and on traffic that never reaches the internet. Pulling a 2 GB container image from ECR through a NAT gateway costs $0.09 in processing and $0 in egress, since ECR is inside AWS. A CI pipeline doing that a hundred times a day is $270 a month of processing on traffic that an endpoint would carry for nothing.
Does the charge stop if the NAT gateway is idle?
No. The hourly charge runs from creation to deletion regardless of traffic. Idle NAT gateways in old VPCs are one of the most common orphans we find, at $32.85 each per month.
Keep reading
Prices checked against AWS list rates on 2 August 2026. AWS changes prices; treat every figure here as a close approximation rather than a quote.
£499 fixed. Free scan first. 20%+ found or it’s free.
The scan is read-only — a role you create and delete, no keys shared — and shows your estimated monthly saving before anyone talks about money.