# Missing S3 gateway endpoint for intra-region EC2 access Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/missing-s3-gateway-endpoint-for-intra-region-ec2-access When EC2 instances in private subnets access Amazon S3 in the same region without a Gateway VPC Endpoint, traffic is routed through a NAT Gateway to... By: Mike Graff Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Missing S3 Gateway Endpoint for Intra-Region EC2 Access The short version When EC2 instances in private subnets access Amazon S3 in the same region without a Gateway VPC Endpoint, traffic is routed through a NAT Gateway to the public S3 endpoint. Mike Graff AWS service [AWS S3](https://www.pointfive.co/efficiency-hub/cloud-services/aws-s3) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0161 Type Inefficient Configuration ## Explanation Why the waste happens and who it affects. Data transfer from S3 to EC2 in the same region is free, but every gigabyte that passes through the NAT Gateway incurs a NAT data processing charge, on top of the NAT Gateway hourly charge. By contrast, provisioning a Gateway Endpoint for S3 routes traffic between EC2 and S3 through the endpoint instead of the NAT Gateway, and gateway endpoints have no hourly or data processing charge. This configuration is especially important for data-intensive applications, such as analytics jobs, backups, or frequent uploads/downloads, where the cumulative data transfer can be substantial. Because the cost is billed as NAT Gateway data processing rather than under S3, it is often misattributed or overlooked during S3 or storage reviews, leading to silent overspend. ## Billing model The pricing dimensions that drive this cost. - S3 does not charge for data transferred to EC2 or other AWS services in the same region, with or without a Gateway VPC Endpoint - Without a Gateway Endpoint, traffic from instances in private subnets reaches S3 through a NAT Gateway, which charges per GB of data processed plus an hourly charge - The cost appears on the bill as NAT Gateway data processing, not under Amazon S3, even though the traffic is S3 requests from EC2 - Gateway VPC Endpoints for S3 have no hourly or data processing charges and remove the NAT processing cost for same-region S3 traffic ## How to detect 5 checks to find it in your estate. - Identify NAT Gateways with significant data processing charges in the billing report - Review whether EC2 instances in the same region are reading from or writing to S3 buckets - Evaluate whether a Gateway VPC Endpoint for S3 is provisioned in the relevant VPCs - Determine whether the absence of the endpoint is contributing to avoidable NAT Gateway data processing charges - Check if the traffic pattern is internal (e.g., S3-to-EC2 backup jobs or intra-app data movement) ## How to fix 4 ways to remove the waste. - Deploy a Gateway VPC Endpoint for S3 in VPCs that generate large intra-region S3 traffic - Update route tables and access policies to route S3 traffic through the endpoint - Validate that EC2-to-S3 traffic is using the private path and no longer passing through the NAT Gateway - Incorporate Gateway Endpoint provisioning into default network infrastructure templates ## Documentation Vendor references for pricing and configuration. - [Gateway Endpoints for Amazon S3 docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html) - [Amazon S3 Pricing aws.amazon.com](https://aws.amazon.com/s3/pricing/) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS S3 CER-0229 ### [Excessive KMS Charges from Missing S3 Bucket Key Configuration](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-kms-charges-from-missing-s3-bucket-key-configuration) S3 buckets configured with SSE-KMS but without Bucket Keys generate a separate KMS request for each object operation. This behavior results in disproportionately high KMS request costs for data-intensive workloads such as analytics,... Storage - AWS S3 CER-0054 ### [Excessive CloudTrail Charges from Bulk S3 Deletes](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-cloudtrail-charges-from-bulk-s3-deletes) When large numbers of objects are deleted from S3 - such as during scripted cleanups or batch jobs that call DeleteObject or DeleteObjects-CloudTrail can log every individual delete operation if data event logging is enabled. This is... Storage - AWS S3 CER-0076 ### [Missing S3 Lifecycle Policy for Incomplete Multipart Uploads](https://www.pointfive.co/efficiency-hub/inefficiencies/missing-s3-lifecycle-policy-for-incomplete-multipart-uploads) Multipart upload allows large files to be uploaded in segments. Each part is stored individually until the upload is finalized by a "CompleteMultipartUpload" request. If this final request is never issued-due to a timeout, crash, failed... Storage --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.