Free calculator
AWS NAT Gateway cost calculator
NAT gateways are the quietest line on an AWS bill, at $0.045 an hour each plus $0.045 per GB processed. A good share of that traffic is often S3 or ECR data that a free VPC endpoint would have carried instead.
Common setup: one per availability zone, per VPC — three AZs means three gateways.
Every byte through the gateway counts — including traffic to S3 and other AWS services.
Just existing (hourly)
$98.55/month
$1,182.60/year · ≈ £77/month
Data processing
$45.00/month
$540.00/year · ≈ £35/month
Total NAT cost
$143.55/month
$1,722.60/year · ≈ £112/month
$0.05/hour per gateway ($32.85/month each, before any traffic) plus $0.05/GB processed. Cross-AZ data transfer, if your routes cross zones, comes on top.
The free scan finds your NAT gateways in every region, pulls their real processed-bytes from CloudWatch, and flags the S3 traffic you could route through a free gateway endpoint.
Estimate the whole billWhere NAT money leaks
- →S3 and DynamoDB traffic through NAT. A gateway VPC endpoint carries this for free. Accounts pulling data from S3 through NAT gateways routinely waste hundreds a month on traffic that never needed a NAT.
- →ECR image pulls. Every container deployment pulls images through the NAT at $0.045/GB. An ECR interface endpoint (~$7.30/AZ/month + $0.01/GB) pays for itself quickly on busy clusters.
- →Three gateways for a dev VPC. Per-AZ NAT redundancy makes sense in production. Dev and staging environments idling three gateways pay ~$100/month for resilience nobody needs.
- →Forgotten VPCs. A NAT gateway in an abandoned VPC bills $33/month forever, even with zero traffic. They survive because deleting a VPC is scary and the line item is small enough to ignore.
- →Cross-AZ routing. Instances in AZ-a routed to a NAT gateway in AZ-b pay cross-AZ transfer on top of NAT processing. Route each subnet to the gateway in its own zone.
Frequently asked questions
How much does a NAT gateway cost?
Two meters run at once: $0.045 per hour just for existing (about $32.85 per month per gateway) and $0.045 per gigabyte of data processed. A typical three-AZ setup costs ~$100/month before a single byte moves.
Why is my NAT gateway data processing so high?
Usually because traffic to AWS's own services is going through it. S3 downloads, ECR image pulls and DynamoDB calls never needed to leave the AWS network at all, and a gateway VPC endpoint for S3 or DynamoDB carries them free.
Are VPC endpoints cheaper than NAT gateways?
Gateway endpoints for S3 and DynamoDB cost nothing at all, with no hourly charge and no per-GB charge. Interface endpoints cost $0.01 an hour per AZ, roughly $7.30 a month, plus $0.01 per GB, which still beats NAT processing at $0.045 per GB as soon as a service moves real volume. Heavy ECR, CloudWatch or SQS traffic usually justifies one.
Do I really need a NAT gateway per availability zone?
In production, one per AZ avoids cross-AZ data charges and keeps working through a zone outage. In dev and staging, running a single gateway, or none at all with public subnets and tight security groups, is a common and defensible saving.
Can I replace a NAT gateway with a NAT instance?
For a low-traffic dev environment, yes. A t4g.nano at around $3 a month can stand in for a $33 a month gateway. You take on the patching and a single point of failure, so treat it as a dev and staging move rather than a production one.