VPC Endpoint Pricing: The Break-Even Math Against a NAT Gateway

There are two kinds of VPC endpoint and only one of them costs money. Gateway endpoints - S3 and DynamoDB only - are free, and there is no good reason not to have them. Interface endpoints, which cover everything else, cost roughly $0.01 per hour per availability zone, or about $7-9 per month per endpoint per AZ, plus about $0.01 per GB of data processed. The reason to buy them is not connectivity, it is that they let you stop routing AWS traffic through a NAT gateway at $0.045/GB. Whether that saves money is arithmetic, and most teams never do it.

Table of contents

• Gateway endpoints are free, so turn them on now
• What interface endpoints actually cost
• The break-even against NAT
• When endpoints are worth it regardless of cost
• How to work out your own number
• The wider point about AWS networking costs
• How this fits the rest of the stack
• FAQ

Gateway endpoints are free, so turn them on now

A gateway endpoint is a route-table entry that sends traffic for S3 or DynamoDB straight to the service across the AWS network, without going through a NAT gateway or an internet gateway.

They cost nothing. Not the endpoint, not the data. There is no hourly charge and no per-GB charge.

If you have private subnets talking to S3 through a NAT gateway, you are paying $0.045 per gigabyte in NAT data-processing charges for traffic that could be free. A single service pulling a few hundred gigabytes of objects a month is throwing away real money for no benefit whatsoever.

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc123 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-0def456

The only two gateway endpoints that exist are S3 and DynamoDB. If your workload touches either from a private subnet, this is the closest thing to free money that AWS offers. Do it before you read the rest of this article.

What interface endpoints actually cost

Interface endpoints - AWS PrivateLink - are the paid kind, and they cover the long tail: Secrets Manager, ECR, SSM, KMS, CloudWatch Logs, SQS, and a few hundred others.

The pricing has two parts:

• An hourly charge per endpoint, per availability zone. Roughly $0.01/hour, which is about $7.30 per month per AZ. An endpoint deployed across three AZs is therefore about $22/month before it moves a single byte.
• A data-processing charge of roughly $0.01/GB. Cheaper than NAT, but not free.

The part that catches people is the multiplication. Each service needs its own endpoint. A typical ECS task pulling an image and reading a secret needs endpoints for ECR API, ECR Docker, S3 (for the image layers - use the free gateway endpoint), CloudWatch Logs, Secrets Manager, and probably SSM. That is five interface endpoints. At three AZs, that is roughly $110/month before any traffic at all.

The endpoint bill is a function of how many services you talk to and how many AZs you span, not how much data you move. That is the opposite of the mental model most people have.

The break-even against NAT

Here is the comparison people should be running and almost never do.

NAT gateway: about $0.045 per hour per AZ (roughly $33/month), plus $0.045 per GB processed.

Interface endpoint: about $0.01 per hour per AZ (roughly $7.30/month), plus $0.01 per GB processed.

The data charge is the interesting part: $0.045/GB versus $0.01/GB is a saving of $0.035 for every gigabyte you move to an endpoint. The fixed cost of the endpoint is roughly $7.30/month per AZ.

So a single interface endpoint in one AZ pays for itself at:

$7.30 / $0.035 per GB = ~209 GB per month

About 200GB per month, per endpoint, per AZ. Below that, the endpoint costs you more than the NAT traffic it replaces. Above it, you save.

The catch: this only helps if you can then delete the NAT gateway entirely. If one straggler service still needs general internet access - to reach a third-party API, or to apt-get a package - the NAT stays, you keep paying its $33/month per AZ, and now you are paying for endpoints on top. Endpoints only produce a large saving when they let you remove NAT from the picture completely.

That is the honest framing that the AWS pricing page will never give you.

When endpoints are worth it regardless of cost

Cost is not always the argument. There are two cases where an interface endpoint is correct even when it loses the arithmetic.

Compliance. If traffic to AWS services must not traverse the public internet - and for some regulated workloads that is a hard requirement, not a preference - endpoints are the mechanism. A NAT gateway sends your traffic out to a public AWS endpoint address; PrivateLink keeps it on the AWS network. Auditors care about this distinction even when the encryption story is identical.

Blast radius. With no internet route at all, a compromised container in a private subnet cannot phone home, cannot pull a second-stage payload, and cannot exfiltrate to an arbitrary host. It can only reach the specific AWS services you gave it endpoints for. That is a genuinely strong containment property, and it is hard to achieve any other way.

If either of these applies, do the endpoints and stop doing the arithmetic. If neither applies, the arithmetic is the whole argument.

How to work out your own number

Do not guess. The data is already in your bill.

Open Cost Explorer, group by Usage Type, and look for NatGateway-Bytes. That is your NAT data-processing volume, and it is the number the whole decision hangs on.

Then work out where that traffic is going. VPC Flow Logs will tell you, and the answer is usually surprising - a large fraction of it is typically S3 (fix with the free gateway endpoint), ECR image pulls (fix with an interface endpoint if you deploy often), and CloudWatch Logs (fix with an interface endpoint if you log heavily).

Then apply the rule:

• Any S3 or DynamoDB traffic through NAT: fix immediately, it is free.
• A service moving more than ~200GB/month per AZ through NAT: an endpoint pays for itself.
• A handful of services you could cover such that the NAT gateway can be deleted entirely: the big win, worth an afternoon of work.
• Everything else: leave it on NAT.

The teams that get burned are the ones who read that endpoints are more secure, add fifteen of them across three AZs, keep the NAT gateway anyway because one service still needs the internet, and discover they have added $300/month to the bill in exchange for nothing.

The wider point about AWS networking costs

VPC endpoint pricing is a good example of the general shape of AWS billing: the compute is legible, and the network is where the money quietly goes.

NAT gateways, interface endpoints, cross-AZ traffic at $0.01/GB in each direction, egress to the internet at $0.09/GB, load balancer capacity units - none of these appear in the mental model when a team sizes its infrastructure, and together they routinely make up a third of the bill.

The defence is boring and effective: know what each network component costs per hour and per gigabyte before you add it, and check the actual traffic volumes in Cost Explorer rather than reasoning from architecture diagrams. Diagrams do not have prices on them, which is precisely the problem.

How this fits the rest of the stack

Whatever you decide here, the cost of the decision only shows up as a bill. The RunxBuild hosting calculator is the right place to model that before committing: the compute, the database, the storage, the bandwidth, the worker - each one is a separate line item, and the real cost of a platform is the sum, not the headline number. The RunxBuild dashboard is where the team sees the actual usage once it is running.

Useful related references:

• VPC vs VPN: What Each One Does and When You Need Both
• VPC Peering: Connection, Routing, and When to Use Transit Gateway
• AWS VPC Cost: NAT Gateway, Data Transfer, and the Hidden Charges
• Network security on RunxBuild

FAQ

Are VPC endpoints free?

Gateway endpoints are - they cover S3 and DynamoDB only, and have no hourly or per-GB charge. Interface endpoints (PrivateLink) cost roughly $0.01/hour per availability zone, about $7.30 per month per AZ, plus about $0.01 per GB of data processed.

Do VPC endpoints save money versus a NAT gateway?

Only above roughly 200GB per month, per endpoint, per AZ - that is where the cheaper data rate ($0.01/GB versus $0.045/GB) covers the endpoint’s fixed hourly cost. The large saving only arrives if the endpoints let you delete the NAT gateway entirely; if one service still needs general internet access, you pay for both.

Why is my VPC endpoint bill so high?

Almost always because the hourly charge multiplies by service and by availability zone. Five interface endpoints across three AZs is about $110 per month before any traffic. The cost is driven by how many services you connect to and how many AZs you span, not by how much data you move.

Which AWS services need an interface endpoint?

Everything except S3 and DynamoDB, which use free gateway endpoints. The common ones for a container workload are ECR API, ECR Docker, CloudWatch Logs, Secrets Manager, SSM, and KMS - which is why the endpoint count adds up quickly.

How do I find how much NAT traffic I have?

In Cost Explorer, group by usage type and look for NatGateway-Bytes. That gives you the data-processing volume the whole break-even calculation depends on. VPC Flow Logs will then tell you which destinations that traffic is going to.