Reading the NAT Gateway Line on Your AWS Bill

NAT Gateway was the third largest line on a bill I was reviewing, above the compute it existed to serve. Two charges make it up: roughly $0.045 per hour for the gateway sitting there, and roughly $0.045 per gigabyte of data processed.

The hourly part is fixed. The per-gigabyte part is the one worth investigating, because a lot of it is traffic to AWS services that never needed to touch the internet.

Find out what is actually flowing

Turn on VPC Flow Logs for the subnet and query the destinations by volume. On the account I was looking at, the top talkers were ECR, S3, CloudWatch Logs, and Secrets Manager. Every container pull, every log line, every secret fetch was going out through NAT and back in.

Gateway endpoints are free

S3 and DynamoDB have gateway endpoints. No hourly charge, no data processing charge, no per-AZ cost. They install a route in your route table and that’s it.

vpc.addGatewayEndpoint('S3', {
    service: ec2.GatewayVpcEndpointAwsService.S3,
});

Interface endpoints cover everything else, and those do cost money: about $0.01 per hour per AZ plus $0.01 per gigabyte. Still cheaper than NAT for anything with real volume, but add them deliberately rather than by the dozen.

The ECR trap

Pulling an image needs three things, and people usually add two of them. ecr.api and ecr.dkr handle authentication and the manifest, but the image layers themselves are served from S3. Without the S3 gateway endpoint, your layer downloads still go through NAT, which is the majority of the bytes.

The endpoints are free, so add S3 first and measure before adding interface endpoints. On that account the gateway endpoint alone took about forty percent off the processing charge.

One more thing to check while you’re in there: a NAT Gateway lives in a single availability zone, so instances in other zones pay cross-AZ transfer to reach it, in both directions. One gateway per AZ costs more per hour and often less overall.