Explanation
Why the waste happens and who it affects.
If this traffic is routed through a NAT Gateway, it incurs both hourly and data processing charges. However, AWS offers VPC Gateway Endpoints (for S3/DynamoDB) and Interface Endpoints (for other services), which provide private access paths that bypass the NAT Gateway entirely. When teams fail to use VPC endpoints - often due to default routing configurations or lack of awareness - they unnecessarily route internal service calls through a costlier, public-facing path. This leads to persistent and avoidable spend.
Billing model
The pricing dimensions that drive this cost.
NAT Gateways are billed based on a flat hourly fee for provisioning, plus a per-gigabyte charge for data processed. VPC Gateway Endpoints for services like S3 and DynamoDB are free to use. Interface Endpoints for other AWS services do incur hourly and per-gigabyte charges but are typically more cost-effective than routing the same traffic through a NAT Gateway.
How to detect
4 checks to find it in your estate.
- Check VPC route tables to identify traffic to AWS services routed through NAT Gateway
- Use CloudWatch metrics to analyze NAT Gateway data processing volumes
- Identify subnets that interact with S3, DynamoDB, or other AWS services and lack a configured VPC endpoint
- Correlate high NAT Gateway traffic with internal service calls to confirm inefficiency
How to fix
4 ways to remove the waste.
- Create VPC Gateway Endpoints for services like S3 and DynamoDB in applicable regions
- Use Interface Endpoints for other AWS services frequently accessed by private subnet workloads
- Associate gateway endpoints with the route tables of private subnets, and enable private DNS on interface endpoints so service hostnames resolve to the endpoint network interfaces instead of routing through the NAT Gateway
- Educate engineering teams on when and how to use VPC endpoints to minimize network costs
Documentation
Vendor references for pricing and configuration.