AWS NAT Gateway costs: why they're so high, and how to cut them

6 min read · Updated 18 August 2026

NAT gateways are one of the most common sources of quiet AWS waste. Each one costs about $33 per month just to exist, plus $0.045 for every GB it processes - and because they're usually set up once and forgotten, most teams end up running more of them, in more places, than they actually need.

How AWS NAT gateway pricing works

A NAT (Network Address Translation) gateway lets resources in a private subnet reach the internet - to pull packages, call third-party APIs, or reach other AWS services - without being publicly reachable themselves. AWS charges for it in two ways:

An hourly charge of about $0.045 per gateway-hour (us-east-1). That's roughly $33 per month, per gateway, whether it processes one byte or a terabyte.
A data-processing charge of about $0.045 per GB that passes through the gateway - on top of any normal data-transfer costs.

Prices vary by region, so check the current AWS VPC pricing page for your own. The headline number to remember: the baseline is per-gateway, and it's always running.

Why your NAT gateway bill is higher than you expect

Three patterns account for most of the surprise:

One gateway per Availability Zone. A highly-available setup runs a NAT gateway in each AZ. Three AZs means three baseline charges (~$99/month) before a single GB is processed. Multiply that across regions and it adds up fast.
Paying to reach AWS services that have a free door. Traffic to Amazon S3 and DynamoDB is billed per GB when it goes through a NAT gateway - but both offer VPC gateway endpoints that route the same traffic privately, for free. A lot of NAT data-processing spend is S3 traffic that never needed the gateway.
Idle gateways in regions you no longer use. Left-over gateways in old or experimental regions keep billing their ~$33/month indefinitely. In one audit we found idle NAT gateways sitting across four regions, quietly costing $120/month for nothing.

How to cut NAT gateway costs (safely)

Find every NAT gateway you have. Check the VPC console in every region - not just your main one. Note which private subnet route tables actually depend on each gateway.
Delete the idle ones. A gateway that no route table points to, or whose subnets have no outbound traffic, is pure waste. Confirm with recent traffic metrics, then remove it - you can recreate one in minutes if you ever need it back.
Add free VPC gateway endpoints for S3 and DynamoDB. This is often the single biggest win: it pulls that traffic off the NAT path and removes the per-GB charge entirely.
Use interface endpoints for other chatty AWS services (ECR, CloudWatch, Secrets Manager, and similar) where the endpoint cost is less than the NAT data-processing you're avoiding.
Right-size high availability. Production usually justifies one gateway per AZ; dev, staging, and low-traffic environments often don't. Consolidating there is safe and immediate.
Consider a NAT instance for low-traffic or dev workloads. A small EC2 NAT instance can be cheaper than a managed gateway when traffic is light and steady - at the cost of managing patching and failover yourself.

None of these require re-architecting. They're configuration changes, each reversible, and together they often cut NAT spend by more than half.

Frequently asked questions

How much does an AWS NAT gateway cost?+

Each NAT gateway costs about $0.045 per hour - roughly $33 per month just to exist - plus $0.045 for every GB of data it processes (us-east-1; prices vary by region). Running one per Availability Zone across several regions is how the bill quietly grows.

Why is my NAT gateway bill so high?+

Three common causes: running one gateway per Availability Zone (three AZs means three baseline charges), paying the per-GB data-processing fee on traffic to S3 or DynamoDB that could use a free VPC gateway endpoint instead, and idle gateways left running in regions you no longer use.

How can I reduce NAT gateway costs?+

Delete idle gateways, add free VPC gateway endpoints for S3 and DynamoDB to remove that traffic from the NAT path, consolidate where high availability isn't required, use interface endpoints for other AWS services, and consider a NAT instance for low-traffic or dev environments.

Is it safe to delete a NAT gateway?+

Yes, if no private-subnet route table still depends on it for outbound traffic. Check the route tables and recent traffic first. Deletion is effectively reversible - you can recreate a gateway in minutes - but validate that nothing needs outbound internet access through it before removing it.

NAT gateway vs NAT instance - which is cheaper?+

A NAT instance can be cheaper for low, steady traffic because you only pay for the EC2 instance, but you manage patching and high availability yourself. A NAT gateway is fully managed and scales automatically but costs more. Rule of thumb: gateway for production, instance for dev or low-traffic workloads.