AWS NAT Gateway Cost (2026): Why It's on Your Bill and Four Cheaper Setups for a Small App

The NAT gateway is the line on an AWS bill that confuses people most. Nobody buys it as a product. It comes with a tutorial, a template or a "production-ready" VPC wizard, and then it bills every hour and every gigabyte.

I want to be upfront about where I stand. aliteq.com runs on Cloudflare Workers and Supabase, not on AWS, and I have never run a NAT gateway for a client. I ran a PC hardware shop for five years, so I read price lists for a living. Everything below is arithmetic on AWS's own published prices, with every formula shown.

This page goes deeper than the NAT section in our guide to why an AWS bill gets so high. That page covers every surprise line. This one covers only the NAT gateway and what to do about it.

How much does an AWS NAT gateway cost per month?

A NAT gateway in US East costs $32.85 a month just for existing: $0.045 an hour times 730 hours. On top of that you pay $0.045 for every GB it processes, so 1 TB adds $46.08. Its public IPv4 address adds $3.65 a month. One gateway carrying 1 TB comes to $82.58.

A NAT gateway (network address translation) lets servers in a private subnet reach the internet without the internet being able to reach them. AWS's VPC pricing page says you are charged for each "NAT Gateway-hour" that your gateway is "provisioned and available". It also says processing charges apply "for each gigabyte processed through the NAT gateway regardless of the traffic's source or destination", and that "Each partial NAT Gateway-hour consumed is billed as a full hour."

There is a third charge most people miss. The same page says: "You also incur standard AWS data transfer charges for all data transferred via the NAT gateway." So a GB sent to the internet through a NAT gateway costs the $0.045 processing fee plus the normal $0.09 data-out rate, once you are past the 100 GB a month that AWS gives free across your account. That is $0.135 per GB.

Where to see it: in Cost Explorer, group by Usage type. In US East, AWS's price file names the lines NatGateway-Hours and NatGateway-Bytes. Other Regions add a Region prefix.

Why is my NAT gateway bill so high?

Because more traffic goes through it than you think, and you probably have more than one. Servers in a private subnet send everything bound outside the VPC through the gateway: S3 reads and writes, container image pulls, package installs and calls to other AWS services. Every one of those gigabytes pays $0.045.

The S3 part surprises people the most. AWS's EC2 pricing page says data moved directly between EC2 and S3 in the same Region is free. Then it adds: "If other AWS services are in the path of your data transfer, you will be charged their associated data processing costs. These services include, but are not limited to, PrivateLink endpoints, NAT Gateway and Transit Gateway." Free traffic becomes paid traffic the moment a NAT gateway sits in the middle.

Container images are the quiet version of the same thing. Amazon ECR's documentation says ECR "uses Amazon S3 to store your image layers", and that containers fetch the image manifest from ECR "and then Amazon S3 to download the actual image layers." Every deploy, scale-out and node replacement pulls those layers again. Through a NAT gateway, each GB is billed.

The second driver is the count. Many VPC templates create one NAT gateway per Availability Zone (an Availability Zone, or AZ, is one of the separate data center groups inside a Region). Three zones means three gateways, $98.55 a month before a single byte. A dev and a staging VPC built from the same template triple it again.

What do four cheaper setups cost for a small app?

In our example app, the default of three NAT gateways costs $155.58 a month. Adding a free S3 gateway endpoint cuts it to $121.02. One shared gateway plus that endpoint is $51.43. A small self-managed NAT instance plus the endpoint is $10.77. Each step down trades away resilience or adds work.

The example is ours, not a measurement of any real company. It is a small app in US East with private subnets in three zones and workloads spread evenly. It sends 1 TB a month through NAT. Of that, 768 GB (75%) is S3 traffic, including container image layers, and 256 GB is internet APIs and package downloads. Data out to the internet is the same in every setup, so it is left out.

Here is the arithmetic behind each bar:

Processing is GB through the gateway times $0.045: 1,024 GB is $46.08, and 256 GB is $11.52. Cross-zone assumes two-thirds of the traffic starts in a zone without the gateway and pays $0.01 out plus $0.01 in per GB. The NAT instance line is $0.0042 an hour times 730, plus an 8 GB gp3 disk at $0.08 per GB-month. The disk size is our assumption.

Should I run one NAT gateway or one per Availability Zone?

One per zone is the resilient choice, and AWS recommends it. One shared gateway is cheaper: in our example it saves $59.35 a month. The catch is in AWS's own documentation. If the gateway's zone goes down, servers in the other zones lose internet access until it comes back.

AWS's NAT gateway documentation says each gateway "is created in a specific Availability Zone and implemented with redundancy in that zone." It continues: "If you have resources in multiple Availability Zones and they share one NAT gateway, and if the NAT gateway's Availability Zone is down, resources in the other Availability Zones lose internet access."

A shared gateway also adds a cross-zone charge. AWS's VPC pricing example says there are data transfer charges between the gateway and an instance "if they are in a different Availability Zone." That is $0.01 per GB each way. AWS's NAT pricing documentation suggests keeping heavy-traffic resources in the gateway's zone, or creating "a NAT gateway in each Availability Zone with resources."

My rule of thumb, from the arithmetic and not from running it: dev, staging and test VPCs rarely need three gateways. Production that must keep calling a payment API during a zone outage probably does. Decide per VPC, on purpose.

What does a regional NAT gateway change?

It changes the setup, not the price. AWS now offers a regional NAT gateway that spreads across zones by itself. AWS's VPC pricing page says it bills "for each hour that the NAT Gateway is configured in each availability zone", so three zones are three NAT gateway-hours, $0.135 an hour. Processing is the same $0.045 per GB.

The documentation lists real conveniences. It needs no public subnet, uses one route for every zone, and expands and contracts with your workloads. It also says it "may take your regional NAT Gateway up to 60 minutes to expand to a new Availability Zone", and that traffic is processed across zones until then. Converting from zonal gateways resets existing connections, so AWS recommends a maintenance window. In Cost Explorer it shows as RegionalNatGateway-Hours and, in US East, USE1-RegionalNatGateway-Bytes.

Which traffic can skip the NAT gateway for free?

Traffic to S3 and DynamoDB in the same Region can skip it for free. A gateway endpoint for either service puts a route in your subnet route tables that bypasses the NAT gateway. AWS's PrivateLink documentation says: "There is no additional charge for using gateway endpoints." No hourly fee, no per-GB fee.

AWS's own VPC pricing example makes the same point. It prices a 1 GB file sent from EC2 to S3 through a NAT gateway at $0.045, then notes that a gateway endpoint avoids it because "There are no data processing or hourly charges for using Gateway Type VPC endpoints."

Because ECR stores image layers in S3, the S3 gateway endpoint also takes most container image bytes off the NAT gateway. In our example, that one change moves 768 GB off the gateway and saves $34.56 a month. Two cautions from the docs. The endpoint only applies to subnets whose route tables you associate with it. And the ECR docs warn that existing connections to S3 "might be briefly interrupted" when you add it.

When does an interface endpoint pay for itself?

At about 626 GB a month per service, if you place it in three zones. Interface endpoints (AWS PrivateLink) cover many other AWS services. Each costs $0.01 an hour in each zone you put it in, plus $0.01 per GB. That beats the NAT gateway's $0.045 per GB only once volume is high enough.

AWS's PrivateLink pricing page says you are "billed for each hour that your VPC endpoint remains provisioned in each Availability Zone". In three zones one endpoint is 3 x $7.30 = $21.90 a month. It saves $0.045 - $0.01 = $0.035 per GB, so it breaks even at 21.90 / 0.035 = 625.7 GB a month. In one zone it breaks even at 208.6 GB.

The trap is adding endpoints for everything. Four services in three zones are 4 x $21.90 = $87.60 a month, more than two idle NAT gateways. If the NAT gateway stays for other traffic, its hours do not go away. Add interface endpoints for the one or two services that actually carry volume, and check the line in Cost Explorer a month later.

Can IPv6 traffic avoid the NAT gateway?

Yes, for destinations that speak IPv6. An egress-only internet gateway lets servers make outbound IPv6 connections while blocking inbound ones, the same job a NAT gateway does for IPv4. AWS's documentation says: "There is no charge for an egress-only internet gateway". Normal data transfer charges still apply.

The limit is the other end. The same documentation says the gateway is "for use with IPv6 traffic only" and that for outbound-only IPv4 you "use a NAT gateway instead." If an IPv6-only server needs to reach an IPv4-only API, AWS routes it through NAT64 on a NAT gateway, which bills as NAT. I could not find a primary figure for how many of the APIs a typical app calls support IPv6, so test your own list before you plan around it.

Is a NAT instance cheaper than a NAT gateway?

On price, yes, by a lot. A t4g.nano instance is $0.0042 an hour, $3.07 a month, with no per-GB processing charge. On everything else, it is a server you now own. You patch it, size it and handle failover, and AWS's documentation recommends the managed gateway instead.

AWS's comparison page lists the differences. A NAT gateway scales "up to 100 Gbps", while an instance's bandwidth "Depends on the bandwidth of the instance type." Failover on instances is "a script" you write. The documentation also warns that AWS's old NAT AMI "reached the end of standard support on December 31, 2020 and end of maintenance support on December 31, 2023", so you would build your own image from a current Amazon Linux.

I did not read a throughput figure for a t4g.nano, so I am not going to tell you it can carry your traffic. Measure it before you trust it. It still pays for its public IPv4 address, its disk and normal data transfer out.

How do I find what's going through my NAT gateway?

Start in Cost Explorer, then go to the gateway's own metrics, then to flow logs. Group Cost Explorer by Usage type and read NatGateway-Bytes. In CloudWatch, the gateway reports BytesOutToDestination and BytesInFromDestination. Flow logs then tell you which server sent the bytes.

AWS's Knowledge Center lays out the same order. Use CloudWatch metrics to find when the traffic spikes. Then query VPC flow logs for that window, with CloudWatch Logs Insights or with Athena if your logs go to S3. To see which servers talk to internet destinations, the article says to use custom flow logs that include the pkt-srcaddr and pkt-dstaddr fields. Flow logs have their own cost, so turn them on for the investigation and check their line too.

If the NAT line is only one of several surprises on your bill, the AWS bill guide walks through public IPv4, data transfer, logs and idle servers with the same prices. For the wider picture of servers, backups and IT spend, see the Cloud & IT Infrastructure hub.