Explanation
Why the waste happens and who it affects.
This adds up quickly for data-intensive or high-frequency workloads. Gateway endpoints for S3 and DynamoDB carry no charge, while interface endpoints have their own hourly per-AZ and per-GB charges, so they pay off only when the NAT processing they replace is larger.
Billing model
The pricing dimensions that drive this cost.
- NAT Gateway: billed for each NAT Gateway-hour (partial hours are billed as full hours) plus a data processing charge for every GB processed, regardless of source or destination; in US East (Ohio), for example, the rates are $0.045 per hour and $0.045 per GB. Standard data transfer charges also apply.
- Gateway endpoints (Amazon S3 and DynamoDB only): no hourly or data processing charges, so routing that traffic through them removes the NAT data processing charge for it.
- Interface endpoints (AWS PrivateLink): billed per VPC endpoint per Availability Zone for every hour the endpoint is provisioned, regardless of traffic, plus a per-GB data processing charge tiered by the total processed across all interface endpoints in the Region.
- Data transfer between EC2 and S3 in the same Region has no data transfer charge whether it passes through a NAT Gateway or an endpoint; the saving this inefficiency targets is the NAT Gateway data processing charge.
How to detect
5 checks to find it in your estate.
- Review VPC architecture for services that communicate with S3, DynamoDB, Secrets Manager, or other AWS-managed APIs
- Check whether Gateway Endpoints for S3 and DynamoDB exist and are attached to relevant route tables
- Identify missing Interface Endpoints for high-traffic services like Secrets Manager, SSM, or KMS
- Analyze NAT Gateway metrics (bytes processed per destination service) to quantify potential endpoint-eligible traffic
- Correlate NAT Gateway charges with known service access patterns to surface reroutable costs
How to fix
5 ways to remove the waste.
- Provision Gateway Endpoints for S3 and DynamoDB in each VPC that accesses those services
- Create Interface Endpoints (via AWS PrivateLink) for services with enough NAT Gateway traffic that the NAT processing charges saved exceed the endpoint's hourly per-AZ and per-GB charges, or where private access is required (e.g., Secrets Manager, CloudWatch Logs)
- Ensure routing tables and DNS settings support private resolution to AWS services
- Embed VPC endpoint provisioning into infrastructure-as-code templates to ensure consistency across accounts and regions
- Monitor NAT Gateway data transfer volume over time to verify cost reduction after endpoint rollout
Documentation
Vendor references for pricing and configuration.