# Suboptimal routing through NAT Gateway instead of VPC endpoint Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-routing-through-nat-gateway-instead-of-vpc-endpoint Workloads in private subnets often access AWS services like S3 or DynamoDB. By: Jason Eckle Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Suboptimal Routing Through NAT Gateway Instead of VPC Endpoint The short version Workloads in private subnets often access AWS services like S3 or DynamoDB. [Jason Eckle](https://www.linkedin.com/in/jasoneckle/) Manager Cloud FinOps @ Etsy AWS service [AWS NAT Gateway](https://www.pointfive.co/efficiency-hub/cloud-services/aws-nat-gateway) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0106 Type Inefficient Configuration ## Explanation Why the waste happens and who it affects. If this traffic is routed through a NAT Gateway, it incurs both hourly and data processing charges. However, AWS offers VPC Gateway Endpoints (for S3/DynamoDB) and Interface Endpoints (for other services), which provide private access paths that bypass the NAT Gateway entirely. When teams fail to use VPC endpoints - often due to default routing configurations or lack of awareness - they unnecessarily route internal service calls through a costlier, public-facing path. This leads to persistent and avoidable spend. ## Billing model The pricing dimensions that drive this cost. NAT Gateways are billed based on a flat hourly fee for provisioning, plus a per-gigabyte charge for data processed. VPC Gateway Endpoints for services like S3 and DynamoDB are free to use. Interface Endpoints for other AWS services do incur hourly and per-gigabyte charges but are typically more cost-effective than routing the same traffic through a NAT Gateway. ## How to detect 4 checks to find it in your estate. - Check VPC route tables to identify traffic to AWS services routed through NAT Gateway - Use CloudWatch metrics to analyze NAT Gateway data processing volumes - Identify subnets that interact with S3, DynamoDB, or other AWS services and lack a configured VPC endpoint - Correlate high NAT Gateway traffic with internal service calls to confirm inefficiency ## How to fix 4 ways to remove the waste. - Create VPC Gateway Endpoints for services like S3 and DynamoDB in applicable regions - Use Interface Endpoints for other AWS services frequently accessed by private subnet workloads - Associate gateway endpoints with the route tables of private subnets, and enable private DNS on interface endpoints so service hostnames resolve to the endpoint network interfaces instead of routing through the NAT Gateway - Educate engineering teams on when and how to use VPC endpoints to minimize network costs ## Documentation Vendor references for pricing and configuration. - [Amazon VPC Pricing aws.amazon.com](https://aws.amazon.com/vpc/pricing/) - [AWS PrivateLink concepts docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html) - [Gateway endpoints - Amazon Virtual Private Cloud docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html) - [Access AWS services through AWS PrivateLink docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS NAT Gateway CER-0128 ### [Suboptimal Cross-AZ Routing to NAT Gateway](https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-cross-az-routing-to-nat-gateway) NAT Gateways are designed to serve private subnets within the same Availability Zone. When subnets in one AZ are configured to route traffic through a NAT Gateway in a different AZ, the traffic crosses AZ boundaries and incurs inter-AZ... Networking - AWS NAT Gateway CER-0325 ### [Excessive NAT Gateway Data Processing Charges from Unoptimized Traffic Routing](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-nat-gateway-data-processing-charges-from-unoptimized-traffic-routing) NAT Gateway charges a per-gigabyte data processing fee on all traffic that passes through it - in either direction - regardless of whether the destination is the public internet or another AWS service in the same region. This per-GB charge... Networking - AWS NAT Gateway CER-0075 ### [Managed NAT Gateway with Excessive Data Transfer](https://www.pointfive.co/efficiency-hub/inefficiencies/managed-nat-gateway-with-excessive-data-transfer) NAT Gateways are convenient for enabling outbound access from private subnets, but in data-intensive environments, they can quietly become a major cost driver. When large volumes of traffic flow through the gateway - particularly during... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.