AWS Networking Costs · Startup Guide
How to Reduce AWS NAT Gateway Costs by 70–80%
NAT Gateway data processing fees silently drain startup budgets. A single 15-minute Terraform change often saves $800–3,000/month - with zero performance impact.
Why NAT Gateway Is the Silent Budget Killer
The pricing trap
NAT Gateway charges two things: an hourly rate ($0.065/hr = $47/month per gateway) and a data processing fee of $0.045/GB for every byte that passes through.
If your ECS containers pull from S3 and ECR, or your EC2 instances send logs to CloudWatch - all of that traffic generates data processing charges. On a startup bill, this shows up as "Data Transfer" and is easy to miss.
Diagnose your setup
- 1. Open AWS Cost Explorer → Group by Service
- 2. Look for "EC2 - Other" line items (NAT is hidden here)
- 3. Enable VPC Flow Logs → send to S3
- 4. Query with Athena: which destination IPs receive the most bytes from your private subnets?
- 5. S3 and DynamoDB IPs = free to fix with Gateway Endpoints
4 Proven Fixes
Apply these in order - highest ROI first.
Gateway VPC Endpoints for S3 and DynamoDB
Traffic to S3 and DynamoDB normally routes through NAT Gateway, generating data processing charges. A Gateway VPC Endpoint routes this traffic over AWS's private network - completely bypassing NAT Gateway.
How to implement
- Create a Gateway Endpoint for S3 in your VPC (Terraform: aws_vpc_endpoint resource)
- Add the endpoint to your route tables (all private subnets)
- Repeat for DynamoDB if you use it
- Cost: $0. Data processing charges to S3/DynamoDB drop to zero
Note: This is the single highest-ROI change in most startup audits. If your EC2 instances pull from S3 (container images, assets, logs), the savings can be dramatic.
Interface Endpoints (AWS PrivateLink) for other services
Services like ECR, Secrets Manager, SSM, and CloudWatch Logs can also route through NAT Gateway. Interface Endpoints (PrivateLink) create private connections to these services, eliminating NAT data processing charges for high-traffic services.
How to implement
- Identify your top NAT Gateway traffic sources via VPC Flow Logs
- Compare Interface Endpoint cost ($7.30/AZ/month) against current NAT processing charges
- Create Interface Endpoints for services where the math makes sense (usually ECR and CloudWatch)
- Adjust security group rules to allow HTTPS from your private subnets
Note: Break-even on an Interface Endpoint is ~160GB of data per month. Most ECS/EKS clusters pulling container images from ECR exceed this easily.
Consolidate cross-AZ NAT Gateway traffic
Cross-AZ data transfer costs $0.01/GB each way. If instances in us-east-1a route through a NAT Gateway in us-east-1b, you pay both cross-AZ transfer and NAT processing charges. Many teams deploy one NAT Gateway per AZ for HA but route traffic inefficiently.
How to implement
- Audit your route tables: each private subnet should route to the NAT Gateway in its own AZ
- If using a single NAT Gateway for cost savings, ensure all subnets route to the same AZ
- Review cross-AZ RDS replica and ElastiCache traffic patterns
Note: High-traffic services with cross-AZ RDS replicas often pay significant data transfer charges that VPC endpoint changes don't address.
Replace with NAT Instance for low-traffic environments
NAT Gateway costs $0.065/hour (~$47/month) in baseline charges before any data processing. For dev and staging environments with low egress traffic, a t4g.nano NAT instance costs ~$3/month.
How to implement
- Identify dev/staging VPCs where NAT Gateway traffic is less than 100GB/month
- Deploy a t4g.nano or t4g.micro EC2 instance with NAT AMI and source/destination check disabled
- Update route tables to point to the instance instead of NAT Gateway
- Accept trade-off: no managed HA (fine for non-production)
Note: Only recommended for non-production environments. Production should keep managed NAT Gateway for reliability.
Real Savings Example
Before → After
Before (typical Series A startup)
- • 3 NAT Gateways (one per AZ): $141/month
- • 500GB/month to S3 via NAT: $22.50/month
- • 200GB/month to ECR via NAT: $9/month
- • 300GB/month to CloudWatch via NAT: $13.50/month
- Total: ~$186/month
After (VPC endpoints + Interface endpoints)
- • 3 NAT Gateways (kept for internet egress): $141/month
- • S3 Gateway Endpoint: $0 (free)
- • ECR Interface Endpoint: $21.90/month (3 AZs)
- • CloudWatch Interface Endpoint: $21.90/month
- Total: ~$185/month
Net saving: ~$22/month - but in a real case with 5TB/month to S3, the Gateway Endpoint alone saves $225/month ($2,700/year) with a 15-minute implementation. Traffic volumes are the key variable.