Glossary
NAT gateway
Also: Network Address Translation gateway
The service through which resources in private subnets reach the internet. Billed per hour and per gigabyte processed.
A NAT gateway costs twice: a fixed hourly rate per gateway and availability zone, and an amount per gigabyte processed. The hourly rate is modest and predictable. The data share is not, and it is the reason this line item regularly reaches four figures a month in grown accounts without anyone ever having decided on it.
The most expensive case is also the most unnecessary: traffic from a private subnet to an AWS service in the same region, such as S3 or DynamoDB. The default path runs through the NAT gateway out to the internet and back, although source and target sit in the same data centre. It is billed like any other traffic.
The remedy is a gateway endpoint. It routes the traffic inside AWS, costs nothing and takes twenty minutes to set up: one resource in Terraform, one entry in the route tables of the private subnets. S3 and DynamoDB have this kind of endpoint; other services have paid interface endpoints.
Interface endpoints in turn cost an hourly rate per availability zone. At high traffic they pay for themselves against the NAT fees, at low traffic they do not. That calculation belongs per endpoint, not as a blanket rule.
The second large item is cross-zone traffic. It costs in both directions and arises when an application in zone A talks to a database in zone B. Zone-aware routing helps, but conflicts with resilience: what needs to be multi-zone stays multi-zone, even when it costs.
How you notice it
- The bill contains a substantial NatGateway-Bytes position.
- Applications in private subnets regularly read or write large volumes from S3.
- There is no VPC endpoint object in the infrastructure description.
- Test and development environments run one NAT gateway per availability zone.
Not to be confused with
- Internet gateway
- The connection of a public subnet to the internet. Free, but it does not handle traffic from private subnets and does not replace a NAT gateway.
- Gateway endpoint
- A free shortcut to S3 and DynamoDB inside the region. The most important lever against NAT cost and set up in twenty minutes.
- Interface endpoint
- For all other AWS services, charged per hour and zone plus a data share. Only worth it above a certain traffic volume.
- Egress cost
- The umbrella term for outbound traffic. NAT fees are a special case that applies even when the data never leaves the AWS region.
When it fits
- Private subnets need outbound reachability, for example for package sources or external interfaces.
- Outbound traffic must use fixed addresses that a partner has allowlisted.
When it does not
- For traffic to S3 or DynamoDB in the same region. That is what the free gateway endpoint is for.
- In environments with no outbound need. A NAT gateway that only produces an hourly rate should be deleted.
- One gateway per zone in a test environment. One is enough there; the resilience is not worth the price.
How to approach it
- Check NatGateway-Bytes in the CURBreak out that usage type and compare it against the total. I have yet to see a grown account where there was nothing to find.
- Create gateway endpoints for S3 and DynamoDBOne Terraform resource, add the route tables of the private subnets, done. Free, no downtime, effective immediately.
- Break traffic down by destinationUse VPC flow logs to see where the bytes actually go. Often a single service or a single job accounts for most of it.
- Calculate interface endpoints individuallyHourly rate per zone against saved NAT fees. Unused interface endpoints are a quiet line item of their own.
- Check cross-zone traffic without sacrificing resilienceWhere application and database sit in different zones for no reason, correct it. Where multi-zone is deliberate, it stays.
Frequently asked
How big is the lever really?
It depends on data volume. For a job reading several gigabytes from S3 every hour it quickly reaches several hundred euros a month for traffic that never left AWS. The gateway endpoint is free and set up in twenty minutes: few measures have a better ratio of effort to effect.
Can the NAT gateway be dropped entirely?
Only if nothing in the private subnets needs to reach out. In practice something almost always remains, such as package sources or external interfaces. In test and development environments, though, three gateways can often be reduced to one.
Gateway endpoint or interface endpoint?
For S3 and DynamoDB always the gateway endpoint: free and with no running fee. Other services only have interface endpoints, and those cost an hourly rate per availability zone. Whether they pay off depends on traffic volume, so the calculation belongs per endpoint.