AWS NAT Gateway costs $0.045/hour per NAT (~$33/month just for uptime) plus $0.045/GB data processed per the AWS VPC pricing page. A 3-AZ HA setup runs ~$99/month minimum before any traffic. The team that uses VPC Endpoints for S3/DynamoDB eliminates most NAT Gateway traffic. The team that uses a NAT instance saves 70-80%. The team that consolidates to 1 AZ for dev environments saves on NAT count.
Table of contents
- The two-part cost
- When data processing dominates
- Save 1: VPC Endpoints (free for S3/DynamoDB)
- Save 2: NAT instance
- Save 3: consolidate to 1 NAT for dev
- Save 4: AZ-aware routing
- Save 5: IPv6 + egress-only IGW
- FAQ
The two-part cost
- Hourly: $0.045/NAT Gateway/hour = ~$32.85/month per NAT. You pay this whether or not traffic flows.
- Data processing: $0.045/GB processed. Every byte that goes through the NAT counts.
For a 3-AZ production VPC with 1 NAT per AZ (the HA pattern):
- Hourly: 3 × $32.85 = ~$98.55/month
- Data: depends on workload. 1TB/day = ~$1,350/month.
The team that runs 3 NAT Gateways for HA accepts this cost. The team that uses 1 NAT for dev saves two-thirds.
When data processing dominates
For high-traffic workloads, data processing dominates. Example: 10TB/month egress:
- 10TB × $0.045/GB = $460/month in data charges alone.
- Plus $33/hour = ~$33/month for 1 NAT.
- Total: ~$493/month.
The team that has heavy outbound traffic (data pipelines, API gateways with backend calls) sees data charges dwarf hourly. The fix: VPC Endpoints to AWS services, CloudFront in front of S3, or NAT instances.
Save 1: VPC Endpoints (free for S3/DynamoDB)
Gateway endpoints for S3 and DynamoDB are free:
aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345 \
--service-name com.amazonaws.us-east-1.s3 \
--route-table-ids rtb-12345Traffic to S3 from a private subnet now bypasses NAT. The team that uses S3 endpoints saves significantly on data processing charges. Interface endpoints (other AWS services) cost $0.01/hour + $0.01/GB but often pay off for high-volume services.
Save 2: NAT instance
EC2 instance acting as NAT. ~$5-10/month for a t4g.nano vs $33 for NAT Gateway.
The trade-off:
- Manual failover (no AWS-managed HA).
- Limited bandwidth (depends on instance type).
- More ops work.
The team that runs a NAT instance for non-critical workloads saves significantly. The team that runs NAT Gateway for production-critical has the right managed-service choice.
Save 3: consolidate to 1 NAT for dev
A dev environment usually doesn’t need 3-AZ HA:
# 1 NAT for the whole VPC
# If AZ goes down, outbound breaks until AZ recoversThe team that runs dev/test with 1 NAT saves $66/month vs 3-AZ HA. The team that runs production with 3 NAT has HA; the team that uses 1 NAT in prod accepts the AZ-failure risk.
Save 4: AZ-aware routing
Keep traffic in the same AZ as the destination when possible. Cross-AZ traffic through a NAT in another AZ is wasteful. The team that uses topology spread constraints or AZ-aware service routing has lower NAT bills.
Save 5: IPv6 + egress-only IGW
For IPv6-only workloads, an egress-only internet gateway is free. NAT Gateway is only needed for IPv4. The team that supports IPv6 fully avoids NAT costs entirely.
FAQ
How much does AWS NAT Gateway cost per month?
$0.045/hour (~$33/month) per NAT plus $0.045/GB data processed. The team that runs 3 NATs for HA pays ~$99/month minimum before traffic.
Is NAT Gateway data processing per AZ or global?
Per NAT, per AZ. The team that has 3 NATs pays data processing 3x for cross-AZ traffic routed through a specific AZ’s NAT.
Can I use a NAT instance instead?
Yes. EC2 instance running iptables NAT, ~$5-10/month. Less reliable (no AWS-managed failover), but much cheaper. The team that uses NAT instances for non-critical workloads saves significantly.
What’s the difference between NAT Gateway and NAT Instance?
NAT Gateway: AWS-managed, AZ-resilient, ~$33/month + data. NAT Instance: self-managed EC2, ~$5-10/month, manual failover. The team that picks NAT Gateway has HA; the team that picks NAT instance has cost savings.
Do NAT Gateway costs qualify for Savings Plans?
Yes - NAT Gateway usage is eligible for Compute Savings Plans (covers data processing and the underlying infrastructure). The team that commits to Savings Plans saves 20-30% on NAT.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: