NAT Gateway Optimization

Overview

NAT Gateways are a common source of unexpectedly high AWS bills. While they provide essential outbound internet connectivity for private subnets, their pricing model—hourly charges plus per-GB data processing fees—can quickly become expensive. Understanding NAT Gateway costs and optimization strategies is critical for the SAA-C03 exam, where questions often focus on reducing data transfer expenses and selecting cost-effective network architectures.

NAT Gateway Cost Reality

NAT Gateway costs have two components: $0.045/hour (~$32.85/month) just to exist, plus $0.045/GB for every gigabyte processed. A 3-AZ deployment costs 3x the base rate (~$98.55/month) before any data transfer. For traffic to AWS services like S3, you're paying for data that could transfer FREE via Gateway Endpoints. A single misconfigured VPC can cost thousands of dollars monthly.

Exam Tip

When exam questions mention 'high NAT Gateway costs' or 'reduce data transfer costs,' look for opportunities to use VPC Endpoints (free for S3/DynamoDB), consolidate NAT Gateways (if HA isn't critical), or evaluate whether NAT instances are more cost-effective for low-traffic scenarios. Always calculate break-even points when comparing options.

Key Concepts

NAT Gateway Pricing Model

NAT Gateway Pricing Components

Hourly Charges (Always-On Billing)

Cost: $0.045/hour in us-east-1 (~$32.85/month)
Charged 24/7 even with zero traffic
Per Availability Zone (each NAT Gateway billed separately)
Regional variation: $0.045 to $0.093/hour depending on region
Cannot be paused or scheduled—deletion is the only way to stop charges

Data Processing Charges

Cost: $0.045/GB in us-east-1
Applies to ALL traffic through NAT Gateway
Both inbound and outbound directions counted
Charged in addition to standard data transfer rates
No volume discounts available

Hidden Cost: Internet Egress

NAT Gateway data processing: $0.045/GB
Plus internet egress: $0.09/GB (first 10 TB)
Total for internet-bound traffic: $0.135/GB
This is often overlooked in cost calculations

Multi-AZ Cost Multiplication

High Availability Best Practice

AWS recommends one NAT Gateway per AZ for fault tolerance
Each NAT Gateway incurs separate hourly charges
3-AZ deployment = 3x base cost before any data transfer

Cost Comparison by Deployment: | Deployment | Base Cost/Month | Annual Base Cost | |------------|-----------------|------------------| | Single AZ | $32.85 | $394.20 | | 2 AZs | $65.70 | $788.40 | | 3 AZs | $98.55 | $1,182.60 |

Cross-AZ Data Transfer Considerations

Traffic from EC2 to NAT Gateway in different AZ: $0.01/GB each way
This adds to NAT Gateway data processing charge
Keep resources and NAT Gateway in same AZ when possible
Total cross-AZ cost: $0.01 (cross-AZ) + $0.045 (NAT processing) = $0.055/GB

Regional Pricing Variations

NAT Gateway Hourly Rates by Region | Region | Hourly Rate | Monthly Base | |--------|-------------|--------------| | US East (N. Virginia) | $0.045 | $32.85 | | US West (Oregon) | $0.045 | $32.85 | | EU (Ireland) | $0.048 | $35.04 | | Asia Pacific (Sydney) | $0.059 | $43.07 | | Asia Pacific (Tokyo) | $0.062 | $45.26 | | South America (São Paulo) | $0.093 | $67.89 |

Key Insight: South America region costs more than 2x US regions. Consider this when designing multi-region architectures or optimizing global deployments.

Per-AZ vs Shared NAT Design Considerations

Per-AZ vs Shared NAT Architecture — Figure 2: NAT Gateway Architecture Options

Per-AZ NAT Gateway Architecture

When to Use Per-AZ NAT Gateways

Production workloads requiring high availability
Applications with strict SLA requirements
Workloads that cannot tolerate single AZ failure
Systems where latency consistency matters

Benefits of Per-AZ Design:

No single point of failure for internet access
No cross-AZ data transfer charges
Consistent low latency (same-AZ routing)
Automatic failover handled by AWS

Cost Trade-offs:

Higher base cost ($98.55/month for 3 AZs)
Data processing costs split across multiple NAT Gateways
Simplified cost attribution per AZ

Architecture Pattern:

AZ-A: Private Subnet → NAT Gateway (AZ-A) → Internet
AZ-B: Private Subnet → NAT Gateway (AZ-B) → Internet
AZ-C: Private Subnet → NAT Gateway (AZ-C) → Internet

Shared NAT Gateway Architecture

When to Use Shared (Single) NAT Gateway

Development and test environments
Non-production workloads
Cost-sensitive applications with relaxed SLA
Batch processing with retry capability
Workloads that can tolerate brief internet access interruption

Benefits of Shared Design:

Lowest base cost ($32.85/month)
Simpler architecture to manage
Easier to monitor (single point of traffic)
All data processing costs in one place

Cost Trade-offs:

Cross-AZ charges apply ($0.01/GB for traffic from other AZs)
Single point of failure for internet access
All traffic funneled through one AZ

Break-Even Analysis (Cross-AZ Charges):

Monthly savings from consolidation: $65.70 (3 AZ → 1 AZ)
Cross-AZ charge: $0.01/GB
Break-even data volume: $65.70 / $0.01 = 6,570 GB

If cross-AZ traffic < 6.5 TB/month: Consolidated is cheaper
If cross-AZ traffic > 6.5 TB/month: Per-AZ is cheaper

NAT Instance Alternative Comparison

NAT Gateway vs NAT Instance Comparison

Feature	NAT Gateway	NAT Instance	Winner
Availability	Highly available within AZ	Use script or ASG for failover	NAT Gateway
Bandwidth	Up to 100 Gbps	Instance type dependent	NAT Gateway
Maintenance	Managed by AWS	You manage (patches, AMI)	NAT Gateway
Hourly Cost	$0.045/hour (~$32.85/mo)	Instance cost (e.g., t3.micro ~$7.59/mo)	NAT Instance
Data Processing	$0.045/GB	$0 (standard transfer only)	NAT Instance
Security Groups	Cannot associate	Full control	NAT Instance
Network ACLs	Full support	Full support	Tie
Port Forwarding	Not supported	Supported	NAT Instance
Bastion Server	Cannot be used as	Can double as bastion	NAT Instance
CloudWatch Metrics	Available	Standard EC2 metrics	NAT Gateway
Reserved/Spot Pricing	Not available	Available	NAT Instance

NAT Instance Cost Analysis

NAT Instance Pricing Options

On-Demand Pricing (Monthly Estimates): | Instance Type | Cost/Month | Max Bandwidth | |---------------|-----------|---------------| | t3.nano | ~$3.80 | Up to 5 Gbps | | t3.micro | ~$7.59 | Up to 5 Gbps | | t3.small | ~$15.18 | Up to 5 Gbps | | t3.medium | ~$30.37 | Up to 5 Gbps | | c5n.large | ~$78.11 | Up to 25 Gbps |

Reserved Instance Savings:

1-year No Upfront: ~30% savings
3-year All Upfront: ~60% savings
t3.micro 3yr reserved: ~$3/month

Spot Instance Option:

Up to 90% savings on compute
Risk: Interruption possible
Best for: Fault-tolerant batch processing

Break-Even Calculation (t3.micro On-Demand):

NAT Gateway: $32.85 (hourly) + $0.045/GB (data)
NAT Instance: $7.59 (hourly) + $0/GB (no data charge)

Break-even: ($32.85 - $7.59) / $0.045 = 561 GB/month

< 561 GB/month: NAT Gateway cheaper (lower base)
> 561 GB/month: NAT Instance cheaper (no data charge)

NAT Instance Configuration

Setting Up NAT Instance

Required Configuration:

Disable source/destination check on the instance
Place in public subnet with public/Elastic IP
Configure security groups for required traffic
Update private subnet route tables to use NAT instance

AMI Options:

Amazon Linux 2 (configure manually)
Community NAT AMIs (verify security)
Custom AMI with iptables configured

High Availability Options:

Auto Scaling Group with min/max = 1
Lambda-triggered failover to standby
Route 53 health checks with failover

When to Choose NAT Instance:

Budget-constrained environments
Need port forwarding capability
Want to use as bastion host also
Low traffic volume (< 500 GB/month)
Can tolerate management overhead

Reducing Data Processing Costs

Strategy 1: VPC Gateway Endpoints

Eliminate 100% of NAT Costs for S3/DynamoDB Traffic

Gateway Endpoints (FREE)

Amazon S3: No hourly or data charges
Amazon DynamoDB: No hourly or data charges
Traffic stays entirely on AWS private network
No bandwidth limit

Implementation:

Create Gateway Endpoint for S3/DynamoDB
Associate with private subnet route tables
Traffic automatically routes via endpoint

Example Savings (10 TB S3 traffic/month): | Method | Monthly Cost | |--------|-------------| | NAT Gateway | $450 data + $32.85 hourly = $482.85 | | S3 Gateway Endpoint | $0 | | Monthly Savings | $482.85 (100%) | | Annual Savings | $5,794.20 |

Key Point: There is NO reason to not have S3 and DynamoDB Gateway Endpoints in every VPC. They are completely free.

Strategy 2: Interface Endpoints

Reduce Costs for High-Volume AWS Service Traffic

Interface Endpoint Pricing:

Hourly: ~$0.01/hour/AZ (~$7.30/month/AZ)
Data: $0.01/GB (vs $0.045/GB for NAT)
77% savings on data processing charges

Break-Even Analysis (Single AZ):

NAT Gateway: $32.85 + ($0.045 × GB)
Interface Endpoint: $7.30 + ($0.01 × GB)

Break-even: ($32.85 - $7.30) / ($0.045 - $0.01) = 729 GB

> 729 GB/month to a service: Interface Endpoint cheaper

High-Value Interface Endpoints: | Service | Common Use Case | Typical Volume | |---------|-----------------|----------------| | ECR | Container image pulls | High (multi-GB images) | | CloudWatch Logs | Log shipping | Medium-High | | Secrets Manager | Secret retrieval | Low | | SQS/SNS | Messaging | Variable | | KMS | Encryption ops | Low |

Multi-AZ Considerations:

3 AZs: $21.90/month base
Break-even drops to ~240 GB/month
Consider AZ-specific deployment vs full coverage

Strategy 3: Architecture Optimization

Design Patterns to Minimize NAT Usage

1. Public Subnet for Internet-Bound Workloads

If instances primarily access internet (not just AWS services)
Use public subnets with security groups
Eliminates NAT Gateway entirely
Trade-off: Direct internet exposure

2. Scheduled Workloads

Use NAT Instance instead of NAT Gateway
Scale to 0 during off-hours
Lambda + EventBridge for automation
Savings: Up to 66% for 8-hour workdays

3. Batch Processing Pattern

Collect requests, process in batches
Reduces number of NAT data transfers
Use compression for large payloads
Consider regional endpoints to avoid internet

4. Caching Layer

Cache external API responses
ElastiCache or local application cache
Reduces repeated external calls
Particularly effective for API integrations

5. Data Compression

Compress data before transfer
Reduces GB processed through NAT
Especially effective for log shipping
CPU cost vs data transfer cost trade-off

S3/DynamoDB Endpoint Savings

Gateway Endpoint Deep Dive

How Gateway Endpoints Work

Technical Implementation:

Route table entries added automatically
Prefix lists define service IP ranges
No ENI created (unlike Interface Endpoints)
No bandwidth or connection limits

Configuration Requirements:

Create endpoint specifying VPC
Associate route tables (all private subnets)
Optionally add endpoint policies for access control

Routing Behavior:

More specific routes win (prefix list is specific)
Traffic to S3/DynamoDB goes via endpoint
Other traffic follows default route (NAT Gateway)
Works alongside NAT Gateway

Endpoint Policies:

Control which S3 buckets/DynamoDB tables accessible
Restrict by AWS account, VPC, or IAM principal
Useful for data exfiltration prevention

Cross-Region Consideration:

Gateway Endpoints are regional
Access cross-region S3: still goes through NAT/Internet
Consider: S3 replication vs cross-region access costs

SHCreate S3 Gateway Endpoint

# Create Gateway Endpoint for S3 - COMPLETELY FREE
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-1234567890abcdef0 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-private-a rtb-private-b rtb-private-c

# Create DynamoDB Gateway Endpoint - COMPLETELY FREE
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-1234567890abcdef0 \
  --service-name com.amazonaws.us-east-1.dynamodb \
  --route-table-ids rtb-private-a rtb-private-b rtb-private-c

# Verify endpoints created
aws ec2 describe-vpc-endpoints \
  --filters "Name=vpc-id,Values=vpc-1234567890abcdef0" \
  --query 'VpcEndpoints[*].[ServiceName,State,VpcEndpointType]' \
  --output table

# Check route table has endpoint route
aws ec2 describe-route-tables \
  --route-table-ids rtb-private-a \
  --query 'RouteTables[0].Routes[?GatewayId!=`null`]'

SHAnalyze NAT Gateway Traffic for Optimization

# Enable VPC Flow Logs to identify traffic patterns
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-1234567890abcdef0 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-destination arn:aws:logs:us-east-1:123456789012:log-group:VPCFlowLogs

# Get NAT Gateway metrics for cost analysis
aws cloudwatch get-metric-statistics \
  --namespace AWS/NATGateway \
  --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-1234567890abcdef0 \
  --start-time $(date -u -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --period 2592000 \
  --statistics Sum

# Calculate monthly NAT Gateway cost
BYTES=$(aws cloudwatch get-metric-statistics \
  --namespace AWS/NATGateway \
  --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-xxx \
  --start-time 2024-01-01T00:00:00Z \
  --end-time 2024-01-31T23:59:59Z \
  --period 2678400 \
  --statistics Sum \
  --query 'Datapoints[0].Sum' \
  --output text)

GB=$(echo "scale=2; $BYTES / 1073741824" | bc)
DATA_COST=$(echo "scale=2; $GB * 0.045" | bc)
HOURLY_COST=32.85
TOTAL=$(echo "scale=2; $DATA_COST + $HOURLY_COST" | bc)

echo "Data processed: ${GB} GB"
echo "Data processing cost: \$${DATA_COST}"
echo "Hourly cost: \$${HOURLY_COST}"
echo "Total monthly cost: \$${TOTAL}"

SHNAT Instance Setup with Auto Scaling

# Create launch template for NAT instance
aws ec2 create-launch-template \
  --launch-template-name nat-instance-template \
  --launch-template-data '{
    "ImageId": "ami-0123456789abcdef0",
    "InstanceType": "t3.micro",
    "NetworkInterfaces": [{
      "DeviceIndex": 0,
      "AssociatePublicIpAddress": true,
      "SubnetId": "subnet-public-a",
      "Groups": ["sg-nat-instance"]
    }],
    "UserData": "IyEvYmluL2Jhc2gKZWNobyAxID4gL3Byb2Mvc3lzL25ldC9pcHY0L2lwX2ZvcndhcmQKaXB0YWJsZXMgLXQgbmF0IC1BIFBPU1RST1VUSU5HIC1vIGVuczUgLWogTUFTUVVFUkFERQ=="
  }'

# Disable source/destination check (required for NAT)
aws ec2 modify-instance-attribute \
  --instance-id i-0123456789abcdef0 \
  --no-source-dest-check

# Create Auto Scaling group for HA
aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name nat-instance-asg \
  --launch-template LaunchTemplateName=nat-instance-template \
  --min-size 1 \
  --max-size 1 \
  --desired-capacity 1 \
  --vpc-zone-identifier "subnet-public-a"

# Schedule scale down for off-hours (development only)
aws autoscaling put-scheduled-action \
  --auto-scaling-group-name nat-instance-asg \
  --scheduled-action-name scale-down-evening \
  --recurrence "0 18 * * MON-FRI" \
  --desired-capacity 0

aws autoscaling put-scheduled-action \
  --auto-scaling-group-name nat-instance-asg \
  --scheduled-action-name scale-up-morning \
  --recurrence "0 8 * * MON-FRI" \
  --desired-capacity 1

Best Practices

Always Create S3/DynamoDB Gateway Endpoints: These are FREE and eliminate 100% of NAT costs for S3/DynamoDB traffic. Do this for every VPC immediately.
Analyze Traffic Before Optimizing: Use VPC Flow Logs and CloudWatch to understand what traffic flows through NAT Gateway before making changes.
Match NAT Strategy to Environment: Use multi-AZ NAT Gateways for production, single AZ or NAT instances for dev/test.
Consider Interface Endpoints for High-Volume AWS Services: If traffic exceeds 729 GB/month to a specific service, Interface Endpoints are cheaper than NAT.
Keep Resources in Same AZ as NAT Gateway: Avoid $0.01/GB cross-AZ charges by routing to NAT Gateway in the same AZ.
Review NAT Costs Monthly: Use Cost Explorer to track NAT Gateway costs and identify optimization opportunities.
Evaluate NAT Instances for Low-Traffic Scenarios: For workloads under 500 GB/month, NAT instances may be significantly more cost-effective.
Use Private Subnets Only When Needed: If instances need outbound-only internet access, evaluate if they truly need private subnets or if security groups on public subnets suffice.

Common Exam Scenarios

NAT Gateway Cost Optimization Scenarios

Scenario	Recommended Solution	Key Reasoning
High NAT Gateway costs, VPC Flow Logs show 80% traffic is to S3	Create S3 Gateway Endpoint	Free endpoint eliminates S3 data processing costs completely
Development VPC with NAT Gateways in 3 AZs costing $98.55/month base	Consolidate to single NAT Gateway in one AZ	Dev environment does not need HA; saves $65.70/month
Production VPC processing 100 GB/month through NAT Gateway	Keep NAT Gateway (consider Gateway Endpoints for S3)	Low volume does not justify NAT instance management overhead
Batch job runs 2 hours nightly and needs outbound internet access	Replace NAT Gateway with scheduled NAT instance using Auto Scaling	NAT Gateway cannot be scheduled; instance can scale to 0
EC2 instances in 3 AZs all routing through single NAT Gateway in AZ-A	Create NAT Gateway in each AZ with same-AZ routing	Eliminates cross-AZ charges and provides HA
Containers pulling 5TB/month of images from ECR through NAT	Create ECR Interface Endpoints (ecr.api, ecr.dkr, logs)	Interface Endpoints cost $0.01/GB vs $0.045/GB for NAT
Need to reduce NAT costs without impacting availability for production	Add VPC Gateway and Interface Endpoints for AWS service traffic	Endpoints reduce data processing without changing HA architecture
Application needs consistent high bandwidth for outbound transfers	Use NAT Gateway (not NAT instance)	NAT Gateway supports up to 100 Gbps; instances are limited

Additional Scenario Analysis

Scenario 9: Multi-Region Data Replication A company replicates 500 GB daily between us-east-1 and eu-west-1 via NAT Gateway.

Current cost: 500 GB × $0.045 (NAT) + $0.02 (cross-region) = $32.50/day = $975/month
Solution: Use S3 Cross-Region Replication instead of custom sync
Savings: Eliminates NAT processing, uses S3's optimized transfer

Scenario 10: Startup Cost Optimization Small startup with limited budget needs private subnet connectivity.

Traffic: ~200 GB/month
Solution: t3.nano NAT instance (~$3.80/month) vs NAT Gateway ($32.85/month)
Savings: $29.05/month ($348.60/year) with acceptable management overhead

Common Pitfalls

Ignoring S3/DynamoDB Gateway Endpoints

Many organizations route S3 and DynamoDB traffic through NAT Gateway when FREE Gateway Endpoints are available. This is the most common NAT cost waste. A company processing 50 TB/month to S3 through NAT Gateway wastes $2,250/month ($27,000/year) on data processing alone. Always create Gateway Endpoints for S3 and DynamoDB in every VPC—there is absolutely no reason not to.

Multi-AZ NAT for Non-Production Environments

Deploying NAT Gateways in multiple AZs for development, test, or staging environments wastes $65.70+ per month per VPC. Non-production workloads rarely require the high availability that multi-AZ provides. Consolidate to a single NAT Gateway for non-production environments and accept the minimal risk of AZ failure for these workloads.

Cross-AZ Traffic to NAT Gateway

If EC2 instances in AZ-A route through a NAT Gateway in AZ-B, you pay an additional $0.01/GB for cross-AZ traffic on top of the $0.045/GB NAT data processing charge. For 10 TB monthly, this adds $100 in unnecessary cross-AZ fees. Always configure routing so traffic goes to a NAT Gateway in the same Availability Zone.

Not Analyzing Traffic Patterns Before Optimizing

Optimizing NAT costs without understanding traffic patterns can lead to ineffective changes. Use VPC Flow Logs and CloudWatch metrics to identify what traffic flows through NAT Gateway before implementing changes. You might discover that 80% of NAT traffic is S3-bound and could be eliminated with a free Gateway Endpoint, while the remaining 20% is unavoidable internet traffic.

Underestimating NAT Instance Management Overhead

While NAT instances can be cheaper for low traffic, they require ongoing management: patching, monitoring, failover scripting, and capacity planning. The official AWS NAT AMI is outdated and may have security vulnerabilities. For production workloads, the management overhead often outweighs cost savings. Only use NAT instances when: (1) budget is the primary constraint, (2) traffic volume is low (under 500 GB/month), or (3) you have mature automation for EC2 management.

Test Your Knowledge

A company has a NAT Gateway in us-east-1 processing 5 TB of S3-bound traffic monthly. What is the MOST cost-effective optimization?

AReplace NAT Gateway with NAT instance

BCreate an S3 Gateway Endpoint

CCreate an S3 Interface Endpoint

DUse NAT Gateway in a cheaper region

A development environment has NAT Gateways in 3 Availability Zones costing $98.55/month in base charges. Traffic is approximately 200 GB/month. How can costs be MOST effectively reduced?

AReplace all NAT Gateways with NAT instances

BConsolidate to a single NAT Gateway

CCreate VPC endpoints for all AWS services

DSwitch to NAT Gateway in a cheaper region

An architect notices that NAT Gateway costs spiked to $500/month. VPC Flow Logs show most traffic is to Amazon ECR for container image pulls. What should they do?

ACreate ECR Gateway Endpoints

BCreate ECR Interface Endpoints (ecr.api, ecr.dkr, and logs)

CReplace NAT Gateway with larger NAT instance

DEnable ECR image caching in S3

A batch processing job runs for 2 hours nightly and needs outbound internet access to third-party APIs. Currently using NAT Gateway at $32.85/month base cost. How can costs be reduced while maintaining functionality?

AUse NAT Gateway with scheduled CloudFormation delete/create

BReplace with scheduled NAT instance using Auto Scaling

CCreate VPC endpoints for the third-party APIs

DConfigure Lambda with VPC to replace the batch job

Networking

NAT Gateway

Managed network address translation service for outbound internet connectivity from private subnets. Highly available within an AZ with up to 100 Gbps bandwidth.

Networking

VPC Gateway Endpoints

Free private connectivity to S3 and DynamoDB without requiring NAT Gateway, internet gateway, or VPN connection.

Networking

VPC Interface Endpoints

Private connectivity to 100+ AWS services via AWS PrivateLink, using elastic network interfaces with private IPs.

Networking

VPC Flow Logs

Capture information about IP traffic going to and from network interfaces. Essential for analyzing NAT Gateway traffic patterns.

Cost Management

AWS Cost Explorer

Visualize and analyze NAT Gateway and data transfer costs. Use to identify high-cost NAT Gateways and optimization opportunities.

Monitoring

Amazon CloudWatch

Monitor NAT Gateway metrics including BytesOutToDestination, BytesInFromDestination, and ConnectionAttemptCount for usage analysis.

Quick Reference

NAT Gateway Pricing Summary (us-east-1)

Component	Cost	Notes
Hourly charge	$0.045/hour (~$32.85/month)	Per NAT Gateway, 24/7
Data processing	$0.045/GB	Both directions
Cross-AZ to NAT	+$0.01/GB	Each way
Internet egress	+$0.09/GB	First 10 TB

Cost Comparison Matrix

Option	Base/Month	Data/GB	Best For
NAT Gateway	$32.85	$0.045	Production, high bandwidth, managed
NAT Instance (t3.micro)	~$7.59	$0	Low traffic, budget-constrained
NAT Instance (t3.nano)	~$3.80	$0	Minimal traffic, cost priority
S3 Gateway Endpoint	$0	$0	All S3 traffic (always use)
DynamoDB Gateway Endpoint	$0	$0	All DynamoDB traffic (always use)
Interface Endpoint (per AZ)	~$7.30/AZ	$0.01	AWS services, >729 GB/month

Break-Even Calculations

Comparison	Break-Even Point	Recommendation
NAT Gateway vs Interface Endpoint (1 AZ)	~729 GB/month	Interface if > 729 GB
NAT Gateway vs Interface Endpoint (3 AZ)	~240 GB/month	Interface if > 240 GB
NAT Gateway vs NAT Instance (t3.micro)	~561 GB/month	Instance if > 561 GB
NAT Gateway vs NAT Instance (t3.nano)	~645 GB/month	Instance if > 645 GB
Multi-AZ NAT vs Single NAT + cross-AZ	~6,570 GB/month	Multi-AZ if > 6.5 TB

Essential CLI Commands

# List all NAT Gateways with costs context
aws ec2 describe-nat-gateways \
  --query 'NatGateways[*].[NatGatewayId,State,SubnetId]' \
  --output table

# Get NAT Gateway data transfer metrics (last 30 days)
aws cloudwatch get-metric-statistics \
  --namespace AWS/NATGateway \
  --metric-name BytesOutToDestination \
  --dimensions Name=NatGatewayId,Value=nat-xxx \
  --start-time $(date -u -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --period 2592000 \
  --statistics Sum

# Create S3 Gateway Endpoint (FREE)
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-xxx \
  --service-name com.amazonaws.REGION.s3 \
  --route-table-ids rtb-xxx

# Create DynamoDB Gateway Endpoint (FREE)
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-xxx \
  --service-name com.amazonaws.REGION.dynamodb \
  --route-table-ids rtb-xxx

# Delete unused NAT Gateway (stop hourly charges)
aws ec2 delete-nat-gateway --nat-gateway-id nat-xxx

# Check endpoint associations
aws ec2 describe-vpc-endpoints \
  --query 'VpcEndpoints[*].[ServiceName,RouteTableIds]'

Cost Optimization Decision Tree

Need outbound connectivity from private subnet?
├── Traffic to S3/DynamoDB?
│   └── YES → Create FREE Gateway Endpoint
├── Traffic to other AWS services?
│   ├── Volume > 729 GB/month? → Interface Endpoint
│   └── Volume < 729 GB/month? → NAT Gateway (simpler)
├── Traffic to Internet?
│   ├── Production workload?
│   │   └── YES → NAT Gateway (per-AZ for HA)
│   ├── Development/test?
│   │   └── YES → Single NAT Gateway or NAT Instance
│   └── Scheduled workload?
│       └── YES → NAT Instance with Auto Scaling
└── Consider: Do you really need private subnets?
    └── If only security concern → Public subnet + Security Groups

Key concepts

Overview

NAT Gateway Cost Reality

Key Concepts

NAT Gateway Pricing Model

NAT Gateway Pricing Components

Multi-AZ Cost Multiplication

Regional Pricing Variations

Per-AZ vs Shared NAT Design Considerations

Per-AZ NAT Gateway Architecture

Shared NAT Gateway Architecture

NAT Instance Alternative Comparison

NAT Gateway vs NAT Instance Comparison

NAT Instance Cost Analysis

NAT Instance Configuration

Reducing Data Processing Costs

Strategy 1: VPC Gateway Endpoints

Strategy 2: Interface Endpoints

Strategy 3: Architecture Optimization

S3/DynamoDB Endpoint Savings

Gateway Endpoint Deep Dive

Best Practices

Common Exam Scenarios

NAT Gateway Cost Optimization Scenarios

Additional Scenario Analysis

Common Pitfalls

Ignoring S3/DynamoDB Gateway Endpoints

Multi-AZ NAT for Non-Production Environments

Cross-AZ Traffic to NAT Gateway

Not Analyzing Traffic Patterns Before Optimizing

Underestimating NAT Instance Management Overhead

Test Your Knowledge

Related Services

NAT Gateway

VPC Gateway Endpoints

VPC Interface Endpoints

VPC Flow Logs

AWS Cost Explorer

Amazon CloudWatch

Quick Reference

NAT Gateway Pricing Summary (us-east-1)

Cost Comparison Matrix

Break-Even Calculations

Essential CLI Commands

Cost Optimization Decision Tree

Further Reading

Related services