AWS NAT gateway data fees can outgrow compute; dev.to post maps the fixes

A familiar surprise in the AWS bill

A post on dev.to walks through a scenario many startups recognise: the first serious production bill arrives, and one line item — labelled "EC2 Other" or "VPC" — turns out to be larger than the compute spend itself. The culprit, according to the author, is usually the NAT gateway, the managed component that lets resources in private subnets reach the internet. For a representative 8-vCPU workload that talks to S3, RDS and a few external APIs, the post puts monthly NAT charges somewhere between $400 and $1,800, frequently exceeding the EC2 bill those workloads run on.

Two fees, and one of them is the trap

The post explains that NAT gateway pricing has two parts in us-east-1: an hourly charge of $0.045 per gateway per availability zone (roughly $33 per gateway per month, multiplied across two or three AZs in a typical highly available setup), and a data-processing fee of $0.045 per GB. The data fee is the one that catches teams out, because it applies to every gigabyte that traverses the gateway — including traffic from a private subnet to S3 in the same region, which never really needs to leave AWS's network but is billed as if it did.

The worked examples make the scale concrete. A modest workload moving 500 GB a month across three AZs pays about $99 in hourly fees plus $23 in data processing, landing near $166 once standard transfer costs are included. A Series A SaaS pushing 10 TB a month through NAT — S3 synchronisation, container image pulls, third-party API calls — sees roughly $1,450 in NAT-related charges against a compute bill the author estimates at $600.

The mitigations the post recommends

The post argues you rarely eliminate NAT entirely; you route around it for traffic that does not need it. Three patterns stand out:

Gateway VPC endpoints for S3 and DynamoDB are free and keep that traffic on AWS's internal network, bypassing NAT entirely. The author's advice is blunt: enable them on day one.

Interface endpoints for other AWS services — ECR, Secrets Manager, STS, CloudWatch Logs — cost around $0.01 per AZ per hour plus $0.01 per GB processed. The post suggests these pay for themselves once a service exceeds roughly 700 GB of monthly NAT traffic, given the gap between $0.01 and $0.045 per GB.

An IPv6 egress-only internet gateway carries no hourly fee, no data-processing fee and no egress charge for outbound IPv6 traffic. The catch is that most VPCs are not dual-stacked, though the author notes major API providers such as Stripe, GitHub and Slack all speak IPv6.

For very small setups — under 500 GB a month — a self-managed NAT instance on a t4g.nano costs about $3 a month, with the tradeoff that patching, monitoring and high availability become your problem. The post also mentions the community-built fck-nat image as a middle ground.

Combined, the author claims these moves can take the 10 TB example from about $1,450 to under $400 a month, requiring one to three engineering days and saving roughly $12,000 a year.

Why the pattern recurs

The post attributes recurring NAT surprises to defaults: AWS reference architectures deploy three AZs of NAT optimised for availability rather than cost; CI/CD pipelines pull images from public registries through the gateway; observability vendors ship over public endpoints unless private connectivity is explicitly enabled; and at small companies nobody owns the bill week to week.

One caveat worth noting: the post was written by a company selling a cost-monitoring product, so its closing pitch is commercial. The pricing mechanics and mitigations it describes, however, are standard, documented AWS features.

Why it matters

NAT gateway economics sit at the intersection of architecture choices and billing line items that are easy to miss. The charges scale linearly with traffic that engineering teams usually consider free — same-region S3 access, image pulls, log shipping — which is precisely why they grow unnoticed. Most of the fixes are cheap, some are free, and the post's core argument holds regardless of its author's business: a one-time architectural review of egress paths, plus ongoing ownership of the bill, can turn a six-figure annual AWS spend problem into a maintenance checklist.