Why is my NAT Gateway bill so high?
7 mins read
Quick answer: A NAT gateway bills two ways. You pay for every hour it runs and for every gigabyte that passes through it. In US regions that is $0.045 an hour and $0.045 a GB. Most surprises are traffic that never needed the gateway: S3 uploads, logs, backups, retries. A gateway endpoint for S3 costs nothing and removes most of it.
If you own an AWS bill, you have seen the line. It sits under EC2-Other, the catch-all for EC2 extras, and it grows when nothing else does. Here is what you pay for, how to find the source, and five fixes.
What does a NAT gateway charge for?
Two meters run at once.
Hours. The gateway bills every hour it exists. In US regions that is $0.045 an hour. A month is about 730 hours, so 730 × $0.045 is about $33. You pay it whether the gateway moves one byte or a billion.
Data processed. Every gigabyte that passes through it costs $0.045 in US regions. This meter has no ceiling.
Rates differ by region. Check yours on the VPC pricing page.
The hours meter is boring. It is the same every month. The data meter is where bills go wrong. It scales with your traffic, and your traffic can change overnight.
Why does it surprise people?
Because so much traffic takes the gateway without anyone deciding it should.
A private subnet has no route to the internet. So AWS routes it through the NAT gateway. That is the point. But the same route also carries traffic to AWS services like S3 and DynamoDB, unless you add an endpoint for them. Your app uploads a backup to S3. The bytes leave the VPC, your private network inside AWS, pass the gateway, and come back to AWS. You pay $0.045 a GB for a round trip that never had to happen.
One team wrote up exactly this. They called it the $1,000 AWS mistake. A missing VPC endpoint sent their S3 traffic through the NAT gateway. The fix took minutes. The bill took a month to notice.
Retries make it worse. A service that fails and tries again sends the same bytes twice. A retry storm at 2 AM can push a week of traffic through in an hour. Package installs on every deploy, log shipping, database dumps. None of it looks like a cost decision. All of it goes through the meter.
How do I see it in Cost Explorer?
Four steps.
Open Cost Explorer. Set the last 14 days, daily granularity.
Filter to the service EC2-Other. NAT gateway charges live here, not under EC2.
Group by Usage Type. Look for two lines.
NatGateway-Bytesis the data meter.NatGateway-Hoursis the hours meter.If the Bytes line jumps, switch to hourly granularity around the jump. AWS bills it at $0.01 per 1,000 usage records a month and keeps 14 days. The start hour tells you which deploy or job did it.
If NatGateway-Bytes is most of the line, the fixes below will help. If NatGateway-Hours is, you have more gateways than you need.
How do I cut the bill?
Five fixes, in the order most people should try them.
Add gateway endpoints for S3 and DynamoDB. AWS charges nothing for gateway-type VPC endpoints. No hourly fee. No per-GB fee. Traffic to those two services stops touching the NAT gateway. This is the fix for most surprise bills.
Keep chatty traffic inside the VPC. If a service talks to another service in your VPC, route it by private IP. Do not send it out and back in.
Decide how many gateways you want. One gateway per Availability Zone, each a separate data center in your region, keeps traffic inside its zone. It also multiplies the hours meter. One gateway for all zones is cheaper to run, but cross-zone traffic has its own transfer charge. Pick based on which meter hurts you.
Find what sends the bytes. Logs, backups, package installs, image pulls, retry storms. Look at the top talkers in VPC Flow Logs, the traffic log AWS can write for your network. Move the heavy ones to an endpoint, cache them, or schedule them.
Consider an interface endpoint for a heavy AWS service. An interface endpoint is a private door to one AWS service inside your VPC. It has its own hourly and per-GB price. Check the VPC pricing page. They pay off when one service sends a lot of traffic through the gateway.
What does 1 TB through a NAT gateway cost?
A worked example, US rates.
Item | Math | Cost |
|---|---|---|
Gateway hours, one month | 730 h × $0.045 | about $33 |
1 TB of data processed | 1,024 GB × $0.045 | about $46 |
Same 1 TB through an S3 gateway endpoint | no charge | $0 |
The gateway itself is a fixed $33. The data is the variable. 1,024 GB × $0.045 is about $46. Ten terabytes is about $460. A retry loop can get you there in a weekend.
Why does it spike without warning?
Because nobody watches the bytes. A retry storm at 2 AM shows up as NAT traffic long before anyone reads a log. A new feature that syncs files to S3 doubles the meter on launch day. The console shows it tomorrow, if someone looks.
AWS bills what you use. A quiet spike is your problem, and you meet it on the invoice. That is why NAT gateway data processing is the first cause on our list of sudden AWS bill jumps.
How does watchmy.cloud help here?
Connect AWS. Read-only billing access. No keys. No access to what you run. One CloudFormation template, about two minutes.
Send it where work happens. Slack for fast triage. Jira for follow-up. API when you want control.
Stop worrying about it. We watch AWS spend for you, so you don't have to keep checking it.
We check your spend every hour. Two rules are on from the start. One fires when a day runs 30% above your 7-day average. One fires when an hour costs three times what that hour normally costs. The alert names the driver, like "EC2-Other +$48.20". You see the retry storm at 3 AM, not on the invoice. A flat $49 a month. See how it works. We are a small team, and this is all we do.
Watching AWS spend is our full-time job. You focus on your product and sleep well.
FAQ
Where does the NAT gateway show up in my AWS bill? Under the service EC2-Other, not EC2. Group by usage type in Cost Explorer. NatGateway-Bytes is data processed. NatGateway-Hours is the running time.
Does traffic to S3 go through the NAT gateway? Yes, from a private subnet, unless you add a gateway VPC endpoint for S3. With the endpoint, S3 traffic stays inside AWS and skips the gateway. AWS charges nothing for gateway endpoints.
Is a NAT gateway charged when idle? Yes. The hours meter runs whether traffic flows or not. In US regions that is $0.045 an hour, about $33 a month per gateway.
Should I run one NAT gateway or one per Availability Zone? One per zone keeps traffic in its zone but multiplies the hourly charge. One for all zones costs fewer hours but adds cross-zone transfer. Pick based on which meter is bigger for you.
How do I find what is sending data through the NAT gateway? Turn on VPC Flow Logs and sort by bytes. The usual suspects are S3 uploads, log shipping, backups, package installs and retry loops.
How fast can I find out about a NAT gateway spike? Cost Explorer shows it the next day, if you look. Tools that read hourly Cost Explorer data, like watchmy.cloud, alert about an hour after the spike lands in the data.
See it before you connect anything: live demo, no sign-up.
More
