The NAT Gateway bills the download too, and three other lines that never say NAT

Ask someone what a NAT Gateway costs and they say about $32 a month. Ask what their NAT Gateway cost last month and the number is usually several times that, with the difference spread across lines that do not say NAT Gateway anywhere.

The NAT Gateway guide covers the two headline components and the S3 case. This post is about the sentence in the pricing page that makes the per-gigabyte charge bigger than people expect, and the three further charges a single gigabyte picks up on its way through.

The processing charge counts both directions#

From the Amazon VPC pricing page, NAT Gateway section:

Data processing charges apply for each gigabyte processed through the NAT gateway regardless of the traffic's source or destination.

"Regardless of source or destination" means a gigabyte your instance downloads is processed, and billed, the same as a gigabyte it uploads. People model NAT cost on upload volume because that is what "egress" sounds like. The common private-subnet workload is the other way round: pulling container images, package updates, model weights, third-party API responses. All of it comes in through the NAT Gateway and all of it is metered.

This matters because inbound data transfer from the internet is free. A gigabyte downloaded directly to a public instance costs nothing in data transfer. The same gigabyte downloaded through a NAT Gateway costs $0.045 in processing. The NAT Gateway is the only reason the download has a price.

The pricing page's own example makes the point with S3. An instance sends a 1 GB file to a bucket in the same Region through a NAT Gateway:

In summary, your charge will be $0.045 for 1 GB data processed by the NAT gateway, and a charge of $0.045 per hour will always apply once the NAT gateway is provisioned and available. The data transfer has no charge in this example.

Zero data transfer. $0.045 of NAT processing, for traffic that never left AWS. And then the fix, in the same paragraph:

To avoid the NAT Gateway Data Processing charge in this example, you could set up a gateway Type VPC endpoint and route the traffic to/from S3 through the VPC endpoint instead of going through the NAT Gateway. There are no data processing or hourly charges for using Gateway Type VPC endpoints.

The three lines that do not say NAT#

Take one gigabyte, downloaded from the internet by an instance in Availability Zone b, through a NAT Gateway in Availability Zone a. Here is what it touches.

1. The processing charge: $0.045. Usage type NatGateway-Bytes. The one line that names the gateway.

2. The zone boundary: $0.01 in each direction. The pricing page is explicit that a NAT Gateway and its clients in different zones is a data transfer event:

There will be data transfer charges between your NAT gateway and EC2 instance if they are in a different Availability Zone.

The rate, from the EC2 data transfer pricing:

Data transferred "in" to and "out" from Amazon EC2 … and Elastic Network Interfaces across Availability Zones in the same AWS Region is charged at $0.01/GB in each direction.

The gigabyte leaves the NAT Gateway's network interface in a and arrives at the instance's in b. Out is charged, in is charged: $0.02 for the crossing. This line appears as regional data transfer, not as NAT Gateway, and it is the charge that a single shared NAT Gateway serving three zones generates on two-thirds of its traffic. One NAT Gateway per zone, with each zone's route table pointing at its own, is the design that removes it. Lab 01 and the guide's placement section cover why that design is also the one that survives a zone failure.

3. The Elastic IP: $0.005 per hour. Every NAT Gateway has a public IPv4 address, and public IPv4 addresses are billed. From the same pricing page:

You use Elastic IP addresses and attach them to resources such as Elastic Load Balancer, NAT Gateway etc. … Any public IPv4 address associated with a resource launched in an Amazon VPC … are charged as in-use public IPv4 address.

Hourly charge for In-use Public IPv4 Address $0.005

So the hourly cost of an idle NAT Gateway is not $0.045. It is $0.045 for the gateway plus $0.005 for its address, $0.05 an hour, about $36 a month before any traffic. The address line is billed under public IPv4, nowhere near the NAT Gateway line.

4. Data transfer out: $0.09 per GB, when it applies. The processing charge is in addition to standard data transfer:

You also incur standard AWS data transfer charges for all data transferred via the NAT gateway.

For the download in this example, data transfer out is zero, because the gigabyte came in. For an upload to the internet it is the Regional data-transfer-out rate on top of the $0.045 processing. The pricing page's regional NAT Gateway example states the stack for a 1 GB upload: $0.045 processing, $0.09 data transfer out, and the hourly charge. Of the two per-gigabyte charges, processing is the smaller, and it is the only one that is NAT-specific; the $0.09 would be paid by a public instance too.

The download column is the one to look at. Free data transfer, and it still costs six and a half cents a gigabyte to receive through a NAT Gateway in the wrong zone.

When an interface endpoint is cheaper#

Gateway endpoints exist for S3 and DynamoDB only, and they are free. Everything else is an interface endpoint, which has its own two lines. From the PrivateLink pricing page:

You will be billed for each hour that your VPC endpoint remains provisioned in each Availability Zone, irrespective of the state of its association with the service … Data processing charges apply for each Gigabyte processed through the VPC endpoint regardless of the traffic's source or destination.

Same "regardless of source or destination" wording, and the rates in us-east-1 are $0.01 per hour per endpoint per zone and $0.01 per GB for the first petabyte. So for traffic to an AWS service that has an interface endpoint, the per-gigabyte comparison is $0.01 against $0.045, a saving of $0.035 per GB, bought with $0.01 per hour per zone.

The break-even is arithmetic. One endpoint in one zone costs $0.01 an hour; it saves $0.035 per GB; it pays for itself at 0.29 GB an hour, which is about 7 GB a day or roughly 200 GB a month through that endpoint. Two zones, double it. Below that volume the NAT Gateway is cheaper for that service. Above it the endpoint is, and the gap widens with volume because the endpoint's hourly charge is fixed.

This is per service. An account that creates interface endpoints for a dozen services "to avoid NAT costs" and pushes a few hundred megabytes a day through most of them has added $0.01 × 12 × 2 zones × 730 hours, about $175 a month, to save a few dollars of processing. The endpoints worth creating are the ones carrying volume: ECR and S3 for image pulls, CloudWatch Logs for a chatty fleet, Systems Manager if you have many instances. The guide's gateway versus interface section covers the non-cost reasons to prefer one or the other.

What to do with it#

Read NatGateway-Bytes against inbound volume, not outbound. If your mental model of NAT cost is "what we send", the bill will keep surprising you. The processing charge meters the download.

Find the zone crossing. Group data transfer by usage type and look for regional transfer between zones. If it tracks your NAT processing volume, your NAT Gateway is serving zones it is not in. One gateway per zone fixes the cost and the availability problem at once; a regional NAT Gateway does the same without the per-zone configuration, at $0.045 an hour per zone it covers.

Count the address. $0.005 an hour per NAT Gateway, under public IPv4, forever. Small, but it is also charged for the NAT Gateways in environments nobody has looked at in a year.

Put S3 and DynamoDB on gateway endpoints without doing any arithmetic. They are free. There is no volume at which they are not the right answer for in-VPC traffic.

Do the arithmetic for everything else. $0.01 per hour per zone against $0.035 per GB saved. Roughly 7 GB a day per zone is the line. Endpoints above it; the NAT Gateway below it.

The through-line with the rest of this site's cost material: the gateway is rarely the expensive part. The traffic you sent through it is, and the pricing page says so in one clause that is easy to read past.