AWS VPC cost has four hidden charges: NAT Gateway hourly + per-GB, inter-AZ data transfer ($0.01/GB each direction), inter-region data transfer ($0.02-$0.09/GB), and public IPv4 addresses ($0.005/hour each). The team that runs a multi-AZ production VPC sees these on the bill. The team that architectures with VPC endpoints, AZ affinity, and IPv6 avoids most of them.
Table of contents
- NAT Gateway: the silent killer
- Inter-AZ data transfer
- Inter-region data transfer
- Public IPv4 addresses
- VPC Endpoints: the cost-saver
- Architecture patterns to reduce VPC cost
- FAQ
NAT Gateway: the silent killer
NAT Gateway costs:
- Hourly: $0.045/hour per NAT Gateway (~$33/month per AZ).
- Data processing: $0.045/GB processed.
A typical 3-AZ production VPC with one NAT Gateway per AZ (recommended for HA): ~$99/month just for NAT Gateway hourly. Plus data processing for all outbound traffic from private subnets.
The team that runs 3 NAT Gateways for HA pays $99/month minimum before any traffic. The team that runs 1 NAT Gateway pays $33/month but has an HA gap (if the AZ fails, outbound breaks).
Alternatives:
- VPC Endpoint for S3/DynamoDB: Free data processing through the endpoint, only standard S3/DynamoDB charges.
- NAT Instance: Run your own NAT on an EC2 instance. $5-10/month for a small instance vs $33 for NAT Gateway. Less reliable, more ops work.
- egress-only internet gateway for IPv6: Free.
- AWS PrivateLink: For accessing AWS services without internet.
The team that adds VPC Endpoints for S3 and DynamoDB eliminates most NAT Gateway traffic for AWS service access.
Inter-AZ data transfer
Data transfer between AZs in the same region:
- $0.01/GB each direction (so $0.02/GB round trip).
For an application with 1TB/day of inter-AZ traffic (database replication, cross-AZ load balancer traffic), that’s $20/day or $600/month in transfer costs alone.
Common sources:
- Database read replicas in another AZ (designed for HA, but expensive).
- Cross-AZ load balancer traffic.
- Microservices that talk to services in different AZs.
The team that places latency-sensitive services in the same AZ as their database avoids the round trip. The team that runs everything multi-AZ for HA accepts the cost.
Inter-region data transfer
Data transfer between AWS regions:
- $0.02-$0.09/GB depending on regions.
- Same region-to-region: $0.02/GB.
- Cross-continent (e.g., US to EU): $0.09/GB.
Common sources:
- Cross-region replication (S3 CRR, RDS cross-region replicas).
- Multi-region deployments with active-active data flow.
- Backups to another region.
The team that uses inter-region replication for DR accepts the cost. The team that does it for “just in case” finds it’s expensive.
Public IPv4 addresses
Since Feb 2024, AWS charges for public IPv4 addresses:
- $0.005/hour per public IPv4 address (~$3.60/month each).
A typical web server with one EIP: ~$3.60/month extra. An ALB with one public IP: ~$3.60/month.
For IPv6:
- No charge for public IPv6 addresses.
The team that uses IPv6 for internet-facing services eliminates this cost. The team that uses IPv4 only (the majority in 2026) accepts the charge.
VPC Endpoints: the cost-saver
VPC Endpoints let private subnets reach AWS services without going through NAT Gateway (and thus without the data processing charge).
Gateway endpoints (free):
- S3
- DynamoDB
Interface endpoints ($0.01/hour + $0.01/GB):
- Most other AWS services (EC2 API, CloudWatch, Secrets Manager, etc.)
The team that adds Gateway Endpoints for S3 and DynamoDB (free, always worth it) and Interface Endpoints for frequently-accessed services (worth it at high volume) saves significantly on NAT Gateway data processing.
Architecture patterns to reduce VPC cost
- Single AZ for non-critical: Dev environments, batch jobs. Saves inter-AZ transfer.
- Same-AZ database + app: App servers and database in the same AZ for latency-critical paths. Use cross-AZ for HA only.
- VPC Endpoints for AWS services: Avoids NAT Gateway data processing.
- IPv6 + egress-only gateway: Avoids IPv4 NAT Gateway entirely.
- Local zones / Wavelength: For low-latency to specific geographies without inter-region transfer.
- Savings Plans on NAT Gateway: Yes, NAT Gateway usage qualifies for Compute Savings Plans.
The team that architects with these patterns has a VPC cost in line with the workload. The team that copies default VPC templates pays for NAT Gateway + inter-AZ transfer + IPv4 charges.
FAQ
How much does NAT Gateway cost?
$0.045/hour per NAT Gateway (~$33/month) plus $0.045/GB data processing. A 3-AZ HA setup is ~$99/month minimum.
How much is inter-AZ transfer?
$0.01/GB each direction, so $0.02/GB round trip. The team that has database read replicas in another AZ pays this on every replication cycle.
Are VPC endpoints free?
Gateway endpoints (S3, DynamoDB) are free. Interface endpoints cost $0.01/hour + $0.01/GB. The team that uses Gateway endpoints for S3 saves on NAT Gateway data processing.
Is IPv6 cheaper than IPv4 in AWS?
Yes - no charge for public IPv6 addresses. AWS added $0.005/hour per public IPv4 in Feb 2024. The team that supports IPv6 avoids this charge.
What is the cheapest way to host a private subnet with internet?
NAT Instance (EC2-based NAT) costs ~$5-10/month vs NAT Gateway at $33/month. Less reliable, but cheaper for low-traffic workloads.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: