AWS NAT Gateway Cost Calculator
NAT Gateway is the most boring line item in the AWS bill — until it's $700. Each NAT GW costs $0.045/hr ($32.85/mo) before a single byte of data moves through it. At 3 AZs for production HA, that's $98.55/month in idle charges alone. Then the data processing meter starts running: $0.045 per GB processed — and if your traffic crosses AZs to reach the NAT GW, the same byte gets counted twice. This calculator models four scenarios side by side: single NAT GW, multi-AZ NAT GW, NAT GW with cross-AZ traffic, and VPC Endpoint replacement. No hand-waving — actual AWS us-east-1 pricing.
📐 NAT Gateway Traffic Profile
Configure your private subnet outbound traffic volume, AZ count, and cross-AZ pattern. The engine computes the full bill: hourly charges, data processing fees, and cross-AZ double-counting where applicable. VPC Endpoint pricing is modeled alongside so you can see the replacement cost in one view.
📋 AWS NAT Gateway & VPC Endpoint Pricing Reference (2026)
Published list prices. NAT Gateway pricing has three components. VPC Endpoint pricing has two. The interaction between them — cross-AZ data transfer — is where most cost models fall apart.
| Resource | Hourly ($/hr) | Data Processing ($/GB) | Cross-AZ Data ($/GB) | Notes |
|---|---|---|---|---|
| NAT Gateway (us-east-1) | $0.045 | $0.045 | $0.01 × 2 = $0.02 | Cross-AZ: data flows AZ→NAT→internet, each leg $0.01/GB |
| NAT Gateway (eu-west-1) | $0.048 | $0.048 | $0.01 × 2 = $0.02 | 10% premium over us-east-1 |
| NAT Gateway (ap-northeast-1) | $0.055 | $0.054 | $0.01 × 2 = $0.02 | 22% premium over us-east-1 |
| NAT Gateway (sa-east-1) | $0.065 | $0.065 | $0.01 × 2 per dir | 44% premium over us-east-1 |
| VPC Endpoint — Gateway (S3, DynamoDB) | $0.00 | $0.00 | $0.00 | Free. No hourly, no processing, no cross-AZ charge. Routes in the VPC route table. |
| VPC Endpoint — Interface (all other AWS services) | $0.01 | $0.01 | $0.01 | Per AZ per endpoint. 1 endpoint × 3 AZs = $21.90/mo hourly + data. |
| Self-Managed NAT on EC2 (t4g.medium, Amazon Linux 2 NAT AMI) | $0.0336 | $0.00 | $0.01 × 2 = $0.02 | ~$24.53/mo per AZ. No per-GB processing fee. Throughput caps at ~5 Gbps per instance. Bandwidth burst credits apply. |
All prices in USD. VPC Gateway Endpoints (S3, DynamoDB) are free — no hourly, no per-GB, no cross-AZ data charge. Interface Endpoints carry hourly + data charges per AZ. Cross-AZ data is $0.01/GB in each direction for all traffic types. Source: AWS Official Pricing Pages, July 2026.
The Line Item Nobody Reads Until It Crosses $500
NAT Gateway is the most boring line item in your AWS bill — until it isn't. The pricing model has three independent cost vectors that compound silently. First: hourly charges — $0.045/hr per NAT GW, every hour of every day, whether a single packet flows through it or not. At one NAT GW that's $32.85/mo. But nobody runs one NAT GW in production — three AZs means three NAT Gateways, and suddenly the idle cost is $98.55/mo. Before a single byte of data.
Second: data processing — $0.045 per GB that passes through the NAT Gateway in either direction. This runs completely independent of the hourly charge. Your EC2 instance downloads a 1 GB container image from Docker Hub? That's $0.045. It uploads 500 MB of logs to an external service? Another $0.023. At 5 TB/month — routine for a mid-sized SaaS pulling container images, package updates, and API responses from the internet — data processing alone is $225/month. Combined with 3-AZ hourly charges: $323.55/mo. For a service whose entire job is "route private subnet packets to the internet and back."
Third, and most insidious: the cross-AZ data double-count. AWS charges $0.01/GB for data crossing Availability Zone boundaries in either direction. When an EC2 instance in us-east-1a sends traffic through a NAT Gateway in us-east-1c (because you deployed one NAT GW and routed all private subnets to it), that byte incurs $0.01/GB to cross from 1a→1c, then another $0.01/GB for the NAT Gateway to process it. If the destination is the public internet, there's yet another $0.01/GB for the response to cross back. The same data that would cost $0.045/GB through a local NAT GW effectively costs $0.065/GB when it crosses AZs — a 44% surcharge paid entirely to AWS's internal network accounting. At multi-terabyte scale, cross-AZ data charges alone can exceed the NAT Gateway hourly cost.
How This Calculator Works
The engine models four scenarios simultaneously, each calculating three cost vectors independently before summing:
- Single NAT GW (No HA): Hourly = 1 × region rate × 730 hrs. Data processing = total GB × region data rate. Cross-AZ = 0 (all traffic originates in the same AZ as the NAT GW).
- Multi-AZ NAT GW (1 per AZ, no cross-AZ traffic): Hourly = AZ count × region rate × 730. Data processing = total GB × region rate. Cross-AZ = 0 — each instance routes through its local NAT GW.
- Multi-AZ NAT GW with Cross-AZ Traffic: Same hourly as #2. Data processing applies to all GB regardless of origin AZ. Cross-AZ tax = (total GB × cross-AZ fraction × $0.01/GB × 2 directions). This models what happens when instances in one AZ use another AZ's NAT GW — deliberate or accidental.
- VPC Endpoint Replacement: Hourly = endpoint count × AZ count × $0.01/hr × 730. Data processing = GB through endpoints × $0.01/GB. Cross-AZ = 0 (Interface Endpoint traffic stays within the VPC backbone and isn't billed as cross-AZ data when routed through the endpoint in the same AZ). Models the cost of replacing NAT Gateway internet access with VPC Endpoints for AWS service access — the component of your NAT GW traffic that never needed to leave AWS in the first place.
The VPC Endpoint Arbitrage: When "Free" Saves $200/Month
A meaningful fraction of NAT Gateway traffic isn't actually going to the internet — it's going to other AWS services. Private subnet EC2 instances pulling from S3, fetching from DynamoDB, writing to CloudWatch Logs, calling SQS, publishing to SNS, invoking Lambda behind API Gateway — all of this traffic routes through the NAT Gateway by default and incurs $0.045/GB processing fees. VPC Gateway Endpoints for S3 and DynamoDB are completely free — no hourly charge, no per-GB fee, no cross-AZ data cost. A single S3-heavy workload pulling 3 TB/month from S3 through a NAT Gateway costs $135/month in data processing alone. Move that traffic to a VPC Gateway Endpoint and the cost drops to $0.00. The endpoint takes about 90 seconds to configure: create the endpoint in the VPC console, attach it to the route table, done.
For services beyond S3 and DynamoDB — ECR, ECS, CloudWatch, Secrets Manager, KMS, SSM, STS — you need Interface Endpoints (AWS PrivateLink). Each costs $0.01/hr ($7.30/mo) per AZ plus $0.01/GB processed. At 4 Interface Endpoints × 3 AZs, that's $87.60/mo in hourly charges — close to the cost of 3 NAT Gateways. But the data processing rate drops from $0.045/GB to $0.01/GB, a 78% reduction. For workloads that pull heavily from ECR (container images) and push to CloudWatch Logs, Interface Endpoints often break even at 500–800 GB/month and save hundreds at multi-TB scale.
| Traffic Destination | VPC Endpoint Type | Endpoint Hourly (3 AZ) | Data Rate (/GB) | vs NAT GW Data Rate | Savings at 1 TB/mo |
|---|---|---|---|---|---|
| S3 | Gateway | $0.00 | $0.00 | vs $0.045 — infinite | +$45.00 |
| DynamoDB | Gateway | $0.00 | $0.00 | vs $0.045 — infinite | +$45.00 |
| ECR (Docker images) | Interface | $21.90 (1 ep × 3 AZ) | $0.01 | 78% cheaper | +$13.10 |
| CloudWatch Logs | Interface | $21.90 (1 ep × 3 AZ) | $0.01 | 78% cheaper | +$13.10 |
| Secrets Manager | Interface | $21.90 (1 ep × 3 AZ) | $0.01 | 78% cheaper | +$13.10 |
| SSM (Session Manager) | Interface | $21.90 (1 ep × 3 AZ) | $0.01 | 78% cheaper | +$13.10 |
| KMS | Interface | $21.90 (1 ep × 3 AZ) | $0.01 | 78% cheaper | +$13.10 |
Savings calculated as: (NAT GW data processing at $0.045/GB − VPC Endpoint data processing at $0 or $0.01/GB) × 1,000 GB − endpoint hourly cost. Negative = endpoint is more expensive at this volume.
The Self-Managed EC2 NAT Alternative
Before NAT Gateway launched in 2015, everyone ran NAT instances on EC2. The pattern still works: launch an Amazon Linux 2 EC2 instance with the NAT AMI, disable source/destination check, add a route in the private subnet route table pointing 0.0.0.0/0 to the instance. A t4g.medium ($0.0336/hr, $24.53/mo) can push ~5 Gbps through its ENI — equivalent to a NAT Gateway's 5 Gbps baseline. The key difference: there is no per-GB data processing charge. Every gigabyte that passes through costs $0.00 beyond the EC2 instance hourly rate. At 5 TB/month, a single t4g.medium NAT instance costs $24.53 total vs a NAT Gateway at $257.85 ($32.85 hourly + $225 data processing). That's a 10× difference.
The tradeoffs are real: you manage the instance (patching, rebooting, scaling), you lose the automatic 45 Gbps burst capability of NAT Gateway, and you need to handle failover yourself (auto-scaling group of 1 with user-data to reassign the route table entry). For dev/staging environments or cost-sensitive production workloads with predictable throughput below 5 Gbps, self-managed NAT instances remain a legitimate architectural choice that AWS's documentation understates. For production workloads above 5 Gbps or requiring automatic failover without custom scripting, NAT Gateway's managed nature justifies the premium.
Who Should Care Most About This Calculator
| Profile | Typical NAT GW Bill | What This Calculator Reveals |
|---|---|---|
| Startup running 3-AZ VPC on default | $100–200/mo | Hourly charges are likely 60-80% of your NAT GW bill. VPC Gateway Endpoints for S3 cost zero dollars and fifteen minutes to configure. The savings are immediate and permanent. |
| Mid-market SaaS (50+ instances) | $300–800/mo | Cross-AZ data tax and data processing now dominate. One NAT GW per AZ is cheaper than routing all traffic through a single NAT GW at your scale. Interface Endpoints for ECR and CloudWatch break even and start saving at ~500 GB/mo each. |
| Data-intensive platform | $800–3,000/mo | At 15+ TB/month, the self-managed EC2 NAT instance is saving you over $2,000/month. You need to weigh the operational burden. Interface Endpoints are saving another $300-600/month on AWS API calls that never needed to leave the VPC. |
| Enterprise multi-account (AWS Organizations) | $2,000–8,000/mo | Centralized egress via Transit Gateway + centralized NAT GW adds another layer of cross-AZ billing. Each hop through a TGW attachment costs $0.02/GB. The architecture diagram that looks cleanest on a whiteboard is often the most expensive in production. |