# Suboptimal cross-AZ routing to NAT Gateway | Cloud Efficiency Hub Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-cross-az-routing-to-nat-gateway NAT Gateways are designed to serve private subnets within the same Availability Zone. By: Mike Graff Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Suboptimal Cross-AZ Routing to NAT Gateway The short version NAT Gateways are designed to serve private subnets within the same Availability Zone. Mike Graff AWS service [AWS NAT Gateway](https://www.pointfive.co/efficiency-hub/cloud-services/aws-nat-gateway) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0128 Type Inefficient Configuration ## Explanation Why the waste happens and who it affects. When subnets in one AZ are configured to route traffic through a NAT Gateway in a different AZ, the traffic crosses AZ boundaries and incurs inter-AZ data transfer charges in addition to the standard NAT processing fees. This typically happens when: - NAT Gateways are deployed in multiple AZs (as recommended for resilience), but - Route tables for all subnets are configured to send traffic to a single NAT Gateway, ignoring AZ placement In high-throughput environments, this misalignment silently generates excess cost. Ensuring that each subnet routes through the NAT Gateway in its own AZ avoids inter-AZ charges and aligns with AWS architectural best practices. ## Billing model The pricing dimensions that drive this cost. - NAT Gateway costs include: - A flat hourly charge per gateway - A per-GB charge for all data processed - If traffic crosses Availability Zones (e.g., from a subnet in AZ-A to a NAT Gateway in AZ-B), inter-AZ transfer charges apply - These are billed separately from NAT Gateway processing fees and increase total data egress cost ## How to detect 4 checks to find it in your estate. - Identify whether multiple NAT Gateways exist across different Availability Zones - Review route table configurations to determine if subnets route to a NAT Gateway in a different AZ - Assess whether route tables are shared or duplicated across subnets without AZ awareness - Analyze inter-AZ traffic patterns associated with NAT Gateway usage to confirm misrouted flows ## How to fix 5 ways to remove the waste. - Update route tables to ensure that each subnet routes outbound traffic through the NAT Gateway in the same AZ - When using zonal NAT Gateways, ensure one is deployed per Availability Zone for fault tolerance and cost efficiency - Alternatively, consider a regional NAT Gateway, which expands automatically into each AZ that has workloads to keep traffic in the same AZ and uses a single route target across subnets; it does not support private NAT, and it can take up to 60 minutes to expand into a new AZ, during which traffic is processed across zones - Review and revise any infrastructure templates or automation that create non-AZ-aware routing - Incorporate AZ-based routing validation into network hygiene checks ## Documentation Vendor references for pricing and configuration. - [AWS NAT Gateway Pricing aws.amazon.com](https://aws.amazon.com/vpc/pricing/) - [Best Practices for NAT Gateways docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS NAT Gateway CER-0106 ### [Suboptimal Routing Through NAT Gateway Instead of VPC Endpoint](https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-routing-through-nat-gateway-instead-of-vpc-endpoint) Workloads in private subnets often access AWS services like S3 or DynamoDB. If this traffic is routed through a NAT Gateway, it incurs both hourly and data processing charges. However, AWS offers VPC Gateway Endpoints (for S3/DynamoDB) and... Networking - AWS NAT Gateway CER-0325 ### [Excessive NAT Gateway Data Processing Charges from Unoptimized Traffic Routing](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-nat-gateway-data-processing-charges-from-unoptimized-traffic-routing) NAT Gateway charges a per-gigabyte data processing fee on all traffic that passes through it - in either direction - regardless of whether the destination is the public internet or another AWS service in the same region. This per-GB charge... Networking - AWS NAT Gateway CER-0075 ### [Managed NAT Gateway with Excessive Data Transfer](https://www.pointfive.co/efficiency-hub/inefficiencies/managed-nat-gateway-with-excessive-data-transfer) NAT Gateways are convenient for enabling outbound access from private subnets, but in data-intensive environments, they can quietly become a major cost driver. When large volumes of traffic flow through the gateway - particularly during... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.