Skip to main content

FinOps

How much does an AWS NAT gateway cost, and how to cut the bill

An AWS NAT gateway is billed twice: by the hour, used or not (USD 0.05 in the Paris Region, USD 36.50 a month), and per gigabyte processed (USD 0.05 per GB), whatever the destination. With one NAT per Availability Zone and traffic to S3, the bill climbs fast. The most profitable lever is almost always a free S3 gateway endpoint.

Published October 24, 2026 · updated November 8, 2026 · 7 min read

In short

  • Fixed cost: USD 36.50 a month per NAT gateway in eu-west-3, plus USD 3.65 for its public IPv4 address. Three zones, three NATs: about USD 120 before the first byte.
  • Variable cost: USD 0.05 per GB processed, including traffic to S3 or DynamoDB in the same Region, on top of data transfer to the internet.
  • First move: S3 and DynamoDB gateway endpoints, free, which take that traffic out of the NAT.
  • Avoid: removing production redundancy to save USD 36.50 a month.

How a NAT gateway is billed

Public prices in eu-west-3 (Paris), taken from the AWS Price List API on 23 October 2026, in US dollars, on the basis of 730 hours a month.

Components of the cost of an AWS NAT gateway in eu-west-3
ComponentPriceGood to know
NAT gateway hourUSD 0.05/hour, USD 36.50 a monthBilled as long as the NAT exists, even with no traffic; any started hour is due.
Data processedUSD 0.05 per GBIn both directions, whatever the destination, S3 in the same Region included.
Public IPv4 addressUSD 0.005/hour, USD 3.65 a monthOne per public NAT, like any public IPv4 address since February 2024.
Data transfer to the internetUSD 0.09 per GB (first 10 TB a month)Billed on top of NAT processing; the first 100 GB a month of the global free tier are free.
Cross-zone trafficUSD 0.01 per GB in each directionWhen an instance goes through the NAT of another Availability Zone.
To the internetUSD 0.14/GB
  1. Instance, private subnet
  2. NAT gatewayUSD 0.05/GB processed
  3. Internet gateway
  4. InternetUSD 0.09/GB out
To S3 without an endpointUSD 0.05/GB
  1. Instance, private subnet
  2. NAT gatewayUSD 0.05/GB processed
  3. Amazon S3, same Region
To S3 with a Gateway endpointFree
  1. Instance, private subnet
  2. S3 Gateway endpointUSD 0
  3. Amazon S3, same Region
To another AWS service with an Interface endpointUSD 0.01/GB
  1. Instance, private subnet
  2. Interface endpointUSD 0.01/GB + USD 0.011/h per zone
  3. AWS service (ECR, SQS, STS…)
To the NAT of another zone+USD 0.01/GB each way
  1. Instance, zone A
  2. Cross-zone trafficUSD 0.01/GB in each direction
  3. NAT gateway, zone BUSD 0.05/GB processed
  • Path to fix
  • Cheapest path
The same byte does not cost the same depending on its path: eu-west-3 prices, excluding the NAT hourly charge (USD 0.05/h).

A priced example

A production VPC across three zones, one NAT gateway per zone, 3 TB a month going out through the NATs: 2 TB to S3 (logs, backups, artefacts), 500 GB to the internet (third-party APIs, updates), 500 GB to other AWS services.

Monthly cost of three NAT gateways processing 3 TB in eu-west-3, before and after an S3 gateway endpoint
ItemBeforeWith an S3 gateway endpoint
3 NATs × 730 hUSD 109.50USD 109.50
3 public IPv4 addressesUSD 10.95USD 10.95
Data processedUSD 150.00 (3,000 GB)USD 50.00 (1,000 GB)
Data transfer to the internet (500 GB)USD 45.00USD 45.00
Monthly totalUSD 315.45USD 215.45

An S3 gateway endpoint, free and created in minutes, removes USD 100 a month, a third of the NAT bill. It is the most common finding: S3 or DynamoDB traffic going through the NAT for lack of an endpoint.

Six ways to cut NAT gateway costs

  • S3 and DynamoDB gateway endpoints: free, with no hourly or processing charge. Associate them with the route tables of the private subnets. Watch out for bucket policies that filter on the NAT's source IP: they will need to filter on the endpoint instead (aws:SourceVpce).
  • Interface endpoints for other services, above a threshold: an endpoint costs USD 0.011 an hour per zone plus USD 0.01 per GB, against USD 0.05 per GB through the NAT. Across three zones, it pays off above about 600 GB a month per service; below that, the NAT is cheaper.
  • Keep traffic in its zone: each private subnet should route to the NAT in its own zone. A single route table for the whole VPC sends traffic across zones and adds USD 0.01 per GB in each direction.
  • A single NAT for non-production: going from three NATs to one in a test environment saves USD 73 a month. Losing one zone then cuts outbound access for the test, which is acceptable; in production, it is not.
  • IPv6 and an egress-only internet gateway: it has no hourly charge and no processing fee. Data transfer to the internet is still billed, and the destination must be reachable over IPv6.
  • Delete NATs with no traffic: a deleted environment often leaves its NAT behind. The other forgotten resources are in the unused AWS resources checklist.

The regional NAT gateway, a newer mode offered by AWS, expands on its own to the zones where your workloads run, with no public subnet per zone. It simplifies the architecture; its hourly and per-GB price is the same in the eu-west-3 price list, so compare on your bill before expecting a saving.

Finding what goes through the NAT

Measure before optimising. Three sources complement each other: Cost Explorer for the amount, each NAT's CloudWatch metrics for the volume, and VPC Flow Logs to see which instance talks to which destination.

# Last month's NAT gateway cost (hours and data processed)
aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 \
  --granularity MONTHLY --metrics UnblendedCost UsageQuantity \
  --filter '{"Dimensions":{"Key":"USAGE_TYPE","Values":["EUW3-NatGateway-Hours","EUW3-NatGateway-Bytes"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE

# Active NAT gateways, with their subnet
aws ec2 describe-nat-gateways --filter Name=state,Values=available \
  --query 'NatGateways[].[NatGatewayId,SubnetId,VpcId]' --output table

# Volume sent out by a NAT over 30 days
aws cloudwatch get-metric-statistics --namespace AWS/NATGateway --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-0123456789abcdef0 \
  --start-time 2026-09-24T00:00:00Z --end-time 2026-10-24T00:00:00Z \
  --period 2592000 --statistics Sum
# Does the VPC already have an S3 endpoint?
aws ec2 describe-vpc-endpoints \
  --filters Name=vpc-id,Values=vpc-0123456789abcdef0 Name=service-name,Values=com.amazonaws.eu-west-3.s3 \
  --query 'VpcEndpoints[].[VpcEndpointId,VpcEndpointType,State]' --output table

# Create an S3 gateway endpoint on the private route tables
aws ec2 create-vpc-endpoint --vpc-id vpc-0123456789abcdef0 --vpc-endpoint-type Gateway \
  --service-name com.amazonaws.eu-west-3.s3 \
  --route-table-ids rtb-0123456789abcdef0 rtb-0123456789abcdef1 rtb-0123456789abcdef2

In VPC Flow Logs, filter the flows on the NAT's network interface and group them by destination address: the address ranges AWS publishes (the ip-ranges.json file) reveal the share of traffic going to S3 or other AWS services.

What the audit checks

The AWS FinOps audit lists the VPC endpoints of each Region and their traffic over 30 days, and flags Interface endpoints that are unused or deployed in too many zones, as well as S3 or DynamoDB Interface endpoints a free gateway endpoint would replace. The network and resilience domains collect the NAT gateways of each Region to assess how they are spread across zones.

Network is only one of the levers: the guide to reduce your AWS bill ranks them all by savings and effort.

AWS NAT gateway cost: frequently asked questions

How much does a NAT gateway cost per month?

In eu-west-3 (Paris), USD 36.50 a month for the hours (USD 0.05 an hour), plus USD 3.65 for its public IPv4 address, plus USD 0.05 per GB processed. A NAT processing 1 TB a month therefore costs about USD 90, excluding data transfer to the internet.

Does traffic to S3 go through the NAT gateway?

Yes, if the VPC has no S3 endpoint: it is then billed USD 0.05 per GB processed, even within the same Region. An S3 gateway endpoint is free and moves that traffic off the NAT.

Do I need one NAT gateway per Availability Zone?

In production, yes: a NAT gateway is redundant within its zone, not across zones. If its zone fails, instances in other zones that went through it lose outbound access. Outside production, a single NAT is often an acceptable trade-off.

Is a NAT instance cheaper than a NAT gateway?

A small EC2 instance configured as NAT costs less per hour and has no per-GB processing fee. In return, you manage its availability, updates and bandwidth. It is an option for a test environment, rarely for production.

Is the regional NAT gateway cheaper?

Not as such: the eu-west-3 price list applies the same hourly and per-GB rates as a zonal NAT. Its benefit is no longer managing one NAT and one public subnet per zone. Compare on your bill depending on how many zones it spans.

Where does your AWS account stand?

Ten questions, three minutes, no access to your account: a security score, a FinOps score and the article to read for each of your three weakest points. Your answers stay in your browser.

Take the free self-assessment

Ready to audit your AWS account?

Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.

Subscribe on AWS MarketplaceSee how it works