Explanation
Why the waste happens and who it affects.
Data transfer from S3 to EC2 in the same region is free, but every gigabyte that passes through the NAT Gateway incurs a NAT data processing charge, on top of the NAT Gateway hourly charge.
By contrast, provisioning a Gateway Endpoint for S3 routes traffic between EC2 and S3 through the endpoint instead of the NAT Gateway, and gateway endpoints have no hourly or data processing charge. This configuration is especially important for data-intensive applications, such as analytics jobs, backups, or frequent uploads/downloads, where the cumulative data transfer can be substantial.
Because the cost is billed as NAT Gateway data processing rather than under S3, it is often misattributed or overlooked during S3 or storage reviews, leading to silent overspend.
Billing model
The pricing dimensions that drive this cost.
- S3 does not charge for data transferred to EC2 or other AWS services in the same region, with or without a Gateway VPC Endpoint
- Without a Gateway Endpoint, traffic from instances in private subnets reaches S3 through a NAT Gateway, which charges per GB of data processed plus an hourly charge
- The cost appears on the bill as NAT Gateway data processing, not under Amazon S3, even though the traffic is S3 requests from EC2
- Gateway VPC Endpoints for S3 have no hourly or data processing charges and remove the NAT processing cost for same-region S3 traffic
How to detect
5 checks to find it in your estate.
- Identify NAT Gateways with significant data processing charges in the billing report
- Review whether EC2 instances in the same region are reading from or writing to S3 buckets
- Evaluate whether a Gateway VPC Endpoint for S3 is provisioned in the relevant VPCs
- Determine whether the absence of the endpoint is contributing to avoidable NAT Gateway data processing charges
- Check if the traffic pattern is internal (e.g., S3-to-EC2 backup jobs or intra-app data movement)
How to fix
4 ways to remove the waste.
- Deploy a Gateway VPC Endpoint for S3 in VPCs that generate large intra-region S3 traffic
- Update route tables and access policies to route S3 traffic through the endpoint
- Validate that EC2-to-S3 traffic is using the private path and no longer passing through the NAT Gateway
- Incorporate Gateway Endpoint provisioning into default network infrastructure templates
Documentation
Vendor references for pricing and configuration.