Explanation
Why the waste happens and who it affects.
When subnets in one AZ are configured to route traffic through a NAT Gateway in a different AZ, the traffic crosses AZ boundaries and incurs inter-AZ data transfer charges in addition to the standard NAT processing fees.
This typically happens when:
- NAT Gateways are deployed in multiple AZs (as recommended for resilience), but
- Route tables for all subnets are configured to send traffic to a single NAT Gateway, ignoring AZ placement
In high-throughput environments, this misalignment silently generates excess cost. Ensuring that each subnet routes through the NAT Gateway in its own AZ avoids inter-AZ charges and aligns with AWS architectural best practices.
Billing model
The pricing dimensions that drive this cost.
- NAT Gateway costs include:
- A flat hourly charge per gateway
- A per-GB charge for all data processed
- If traffic crosses Availability Zones (e.g., from a subnet in AZ-A to a NAT Gateway in AZ-B), inter-AZ transfer charges apply
- These are billed separately from NAT Gateway processing fees and increase total data egress cost
How to detect
4 checks to find it in your estate.
- Identify whether multiple NAT Gateways exist across different Availability Zones
- Review route table configurations to determine if subnets route to a NAT Gateway in a different AZ
- Assess whether route tables are shared or duplicated across subnets without AZ awareness
- Analyze inter-AZ traffic patterns associated with NAT Gateway usage to confirm misrouted flows
How to fix
5 ways to remove the waste.
- Update route tables to ensure that each subnet routes outbound traffic through the NAT Gateway in the same AZ
- When using zonal NAT Gateways, ensure one is deployed per Availability Zone for fault tolerance and cost efficiency
- Alternatively, consider a regional NAT Gateway, which expands automatically into each AZ that has workloads to keep traffic in the same AZ and uses a single route target across subnets; it does not support private NAT, and it can take up to 60 minutes to expand into a new AZ, during which traffic is processed across zones
- Review and revise any infrastructure templates or automation that create non-AZ-aware routing
- Incorporate AZ-based routing validation into network hygiene checks
Documentation
Vendor references for pricing and configuration.