A NAT gateway lets the instances of a private subnet reach the internet, and AWS bills it twice over. In AWS's words, "When you provision a NAT gateway, you are charged for each hour that your NAT gateway is available and each gigabyte of data that it processes", and on top of that, "You also incur standard AWS data transfer charges for all data transferred via the NAT gateway". A NAT gateway's bill is a data transfer bill in disguise, so this article covers both: what AWS NAT gateway pricing is made of, how traffic leaves an Amazon Virtual Private Cloud (Amazon VPC) under the hood, what data transfer costs between zones, between Regions and to the internet, and the ways AWS documents to cut the bill, priced with the list prices of the Paris Region (eu-west-3). Four architectures show what the levers do to whole monthly bills, and the cost section opens with an index of the levers, in the order to work through them.
Prices in this article are AWS list prices for the EU (Paris) Region, in USD before tax, from the AWS Price List; Amazon CloudFront's are its prices at its Europe edge locations. The offer files and their publication dates are listed in the Sources section, and each table repeats the dates of its own prices. Monthly amounts (730 hours), totals, percentages and break-evens are computed from these prices. A TB is 1,024 GB, as the price list's tiers count it. The free allowances, 100 GB a month of data transfer out and the CloudFront free tier, are not deducted.
What a NAT gateway is, and why its bill is a data transfer bill
In AWS's words, "A NAT gateway is a Network Address Translation (NAT) service. You can use a NAT gateway so that instances in a private subnet can connect to services outside your VPC but external services can't initiate a connection with those instances." The same page describes the translation: "Both private and public NAT gateways map the source private IPv4 address of the instances to the private IPv4 address of the NAT gateway." So every connection out, and every byte of it, goes through the gateway.
The NAT gateway is one of the ways out of a VPC that AWS documents, with the internet gateway and, for IPv6, the egress-only internet gateway; AWS services such as Amazon Simple Storage Service (Amazon S3) and Amazon DynamoDB can also be reached through VPC endpoints, without any of them. Each one bills differently:
The ways out of a VPC, and what each one bills in Paris
| Way out | Its own charge in Paris | What it reaches |
|---|---|---|
| Internet gateway | None: data transfer out and public IPv4 addresses bill | The internet, both ways |
| NAT gateway, zonal | $0.05 an hour, and $0.05 per GB processed | The internet, outbound only; other networks, as a private NAT gateway |
| NAT gateway, regional | $0.05 an hour per zone, and $0.05 per GB processed | The internet, outbound only |
| Egress-only internet gateway | None: data transfer out bills | The internet over IPv6, outbound only |
| Gateway endpoint | None | Amazon S3 and DynamoDB in the same Region, from the VPC's own subnets |
| Interface endpoint | $0.011 an hour per zone, and $0.01 per GB processed | Many AWS services and your own, also from on-premises networks, peered VPCs and transit gateways |
| NAT instance | The instance's own hours | The internet, outbound only; AWS recommends NAT gateways instead |
USD, before tax. AWS Price List, eu-west-3, offer files published September 17, 2026 and October 15, 2026, fetched October 16, 2026.
Well-Architected names the habit that lets these lines grow (COST08-BP01): "When designing a solution in the cloud, data transfer fees are usually neglected due to habits of designing architecture using on-premises data centers or lack of knowledge." And the rule behind them: "Data transfer charges in AWS are determined by the source, destination, and volume of traffic." The EC2 article shows where these lines sit next to an instance's own; this one follows the traffic.
How traffic leaves a VPC, under the hood
AWS documents its networking at the level of route tables, gateways, network interfaces and Availability Zones. It does not say how a NAT gateway or a gateway endpoint is built inside its network, so this article does not either. What it does document decides each line of the bill, and the diagram below draws the three ways out of a private subnet, with what each one bills:
- The internet gateway connects the public subnets to the internet. It has no charge of its own; the bytes it carries out of AWS are billed as data transfer out, $0.09 per GB for the first 10 TB a month, and a public IPv4 address costs $0.005 an hour.
- A NAT gateway lets instances in private subnets open connections out, never in. It lives in one Availability Zone and bills $0.05 an hour, $0.05 per GB it processes in either direction, and its Elastic IP address as a public IPv4 address.
- An interface endpoint puts a network interface of an AWS service in the subnets you choose, one per zone: $0.011 an hour per zone and $0.01 per GB, in place of the NAT gateway's $0.05.
- A gateway endpoint is a route to Amazon S3 or DynamoDB in the subnet's route table. It has no hourly or per-GB charge, and data between S3 and EC2 in the same Region is free.
Route tables decide the path, and so the price
"A route table contains a set of rules, called routes, that are used to determine where network traffic from your VPC is directed", and "Each route in a route table specifies the range of IP addresses where you want the traffic to go (the destination) and the gateway, network interface, or connection through which to send the traffic (the target)." Every route table has a local route, "A default route for communication within the VPC", and the route to the internet is what makes a subnet public: "If a subnet is associated with a route table that has a route to an internet gateway, it's known as a public subnet", and "If a subnet is associated with a route table that does not have a route to an internet gateway, it's known as a private subnet". So the bill follows the route table: the same bytes to Amazon S3 cost $0.05 per GB through a route to a NAT gateway, and nothing more through a route to a gateway endpoint.
The internet gateway: free, and the start of data transfer out
"An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet", and "It does not cause availability risks or bandwidth constraints on your network traffic." It translates addresses too, one to one: "The internet gateway logically provides the one-to-one NAT on behalf of your instance." It has no price of its own: "There is no charge for an internet gateway, but there are data transfer charges for EC2 instances that use internet gateways." An instance needs a public address to use it, and "AWS charges for all public IPv4 addresses, including public IPv4 addresses associated with running instances and Elastic IP addresses": $0.005 per hour per address in Paris, and "The bill is calculated in one-second increments, with a minimum of 60 seconds":
One public IPv4 address
$3.65 a monthin Paris, in use or idle, 730 hours, computed: the internet gateway costs nothing, the address an instance or a NAT gateway needs to use it does.
Computed from the AWS Price List · eu-west-3 · Sep 17, 2026
Traffic to AWS services through it stays on AWS's network (How Amazon VPC works): "Packets that originate from the AWS network with a destination on the AWS network stay on the AWS global network, except traffic to or from AWS China Regions and the AWS European Sovereign Cloud Region." And the VPC FAQs add: "Data transfer charges are not incurred when accessing Amazon Web Services, such as Amazon S3, via your VPC’s Internet gateway."
The NAT gateway: one zone, one address, a meter on every GB
A NAT gateway is zonal: "Each NAT gateway is created in a specific Availability Zone and implemented with redundancy in that zone", and "We create a requester-managed network interface for your NAT gateway." A public one sits in a public subnet, with an address of its own: "You create a public NAT gateway in a public subnet and must associate an Elastic IP address with the NAT gateway at creation", and "Connections must always be initiated from within the VPC containing the NAT gateway." Its zone is a risk for every zone that shares it, in AWS's words: "If you have resources in multiple Availability Zones and they share one NAT gateway, and if the NAT gateway's Availability Zone is down, resources in the other Availability Zones lose internet access. To improve resiliency, create a NAT gateway in each Availability Zone, and configure your routing to ensure that resources use the NAT gateway in the same Availability Zone." Pattern 2 prices that choice. What one gateway handles:
What one NAT gateway handles, in AWS's figures
| Limit | AWS's figure |
|---|---|
| Bandwidth | 5 Gbps, scaling automatically up to 100 Gbps |
| Packets | One million per second, scaling automatically up to 10 million |
| Connections | Up to 55,000 simultaneous connections per IPv4 address to each unique destination |
| IPv4 addresses | Up to 8: 1 primary and 7 secondary, each a public IPv4 address billed by the hour on a public NAT gateway |
| Idle connections | Idle after 350 seconds without activity, when not closed gracefully |
The first four rows are from NAT gateway basics, the last from the NAT gateway metrics page. Two limits on the same basics page shape architectures: "You can't route traffic to a NAT gateway through a VPC peering connection", and "You can't associate a security group with a NAT gateway." A private NAT gateway, with no Elastic IP address, lets instances "connect to other VPCs or your on-premises network through a private NAT gateway" (NAT gateways), for instance "using a pool of allow-listed addresses", or "even if they have overlapping CIDR ranges" (NAT gateway use cases). The Paris price list has one set of NAT gateway rows for both kinds. And the meter runs on every byte:
Data processing charges apply for each gigabyte processed through the NAT gateway regardless of the traffic’s source or destination.
The same page adds "Each partial NAT Gateway-hour consumed is billed as a full hour." The NAT gateway metrics split the bytes four ways: BytesOutToDestination ("The number of bytes sent out through the NAT gateway to the destination."), BytesInFromDestination, BytesInFromSource and BytesOutToSource. Downloads count as much as uploads: a GB pulled from the internet is free as data transfer in, since "There’s no charge for data transfer from the internet to AWS", but the NAT gateway processes it, and bills it. AWS's own example on the VPC pricing page sends 1 GB from an instance to an S3 bucket in the same Region through a NAT gateway: the gateway's hours and its processing are billed, the transfer itself is not, and "There will be data transfer charges between your NAT gateway and EC2 instance if they are in a different Availability Zone." Its note: "To avoid the NAT Gateway Data Processing charge in this example, you could set up a gateway Type VPC endpoint and route the traffic to/from S3 through the VPC endpoint instead of going through the NAT Gateway. There are no data processing or hourly charges for using Gateway Type VPC endpoints."
The regional NAT gateway: one for the VPC, billed per zone
A VPC can also have one NAT gateway for all its zones (Regional NAT gateways): "A regional NAT gateway automatically expands across Availability Zones based on your workload presence. Unlike standard NAT gateways (referred to as zonal NAT gateways), which operate in a single Availability Zone, regional NAT gateways follow your workloads to provide automatic high availability." It needs no public subnet, "with a regional NAT Gateway, you don't need to create a public subnet to host it", and one route serves every zone. It follows the workloads both ways: "When you launch resources in a new Availability Zone, the regional NAT gateway detects the presence of an network interface(ENI) in that Availability Zone and automatically expands to that zone. Similarly, the NAT Gateway contracts from the Availability Zone that has no active workloads." It has two modes, "Automatic mode – In this mode, AWS automatically manages IP addresses and Availability Zone expansion (recommended)" and a manual mode where you manage both.
- Zonal: each NAT gateway lives in one zone, in a public subnet, and the route table of each private subnet points to the gateway of its own zone: $0.05 an hour for each gateway, and $0.05 per GB.
- Regional: one NAT gateway for the VPC, with no public subnet and one route for every zone. It expands to the zones that have workloads and bills $0.05 an hour for each zone it is configured in, and $0.05 per GB.
- When a workload starts in a new zone, the regional NAT gateway can take up to 60 minutes to expand to it; until then, that zone's traffic is processed in another zone. It offers no private NAT.
It is billed per zone, in the VPC pricing page's words: "you are charged for each hour that the NAT Gateway is configured in each availability zone. For example, if your regional NAT is running across three Availability Zones(AZs) for one hour, you'll be billed for three 'NAT Gateway-hours'." In Paris its rows have the zonal rows' prices, $0.05 per zone-hour and $0.05 per GB, so a regional NAT gateway in three zones costs $109.50 a month before its traffic, computed, what three zonal gateways cost. What it changes is the work:
- Price
- $0.05 an hour per gateway, $0.05 per GB
- Where it lives
- One zone, in a public subnet, with an Elastic IP address
- Routes
- Each private subnet to the gateway of its own zone
- A new zone
- A new gateway and its routes, created by you
- Addresses
- Up to 8 IPv4 addresses per gateway
- Private NAT
- Yes
- Price
- $0.05 an hour per zone it is configured in, $0.05 per GB
- Where it lives
- The VPC itself, with no public subnet
- Routes
- One route for every zone
- A new zone
- It expands by itself, in up to 60 minutes, and contracts from a zone without workloads
- Addresses
- Up to 32 IP addresses per zone
- Private NAT
- No: AWS recommends zonal NAT gateways for it
What differs: the work, the routes and the zones without workloads, not the price per zone: in three zones, a regional NAT gateway bills what three zonal ones bill.
The same page has three cautions. The expansion has a network cost: "It may take your regional NAT Gateway up to 60 minutes to expand to a new Availability Zone after a resource is instantiated there. Until this expansion is complete, the relevant traffic from this resource is processed across zones by your regional NAT Gateway in one of the existing Availability Zones." The move from zonal to regional "will reset your existing connections. We recommend that you complete these steps in your maintenance window." And "Regional NAT gateways are not supported in constrained Availability Zones." The page does not say how many public IPv4 addresses automatic mode uses in each zone; each one bills by the hour.
The egress-only internet gateway: IPv6 out, with no processing fee
For IPv6, AWS has a gateway that only lets traffic out (egress-only internet gateway): "An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection with your instances." It is "for use with IPv6 traffic only", and "There is no charge for an egress-only internet gateway, but there are data transfer charges for EC2 instances that use internet gateways." The whitepaper on multi-VPC networks says the same: "Egress-only internet gateways have no charge." So traffic to IPv6 destinations can leave without the NAT gateway's processing:
AWS says
No chargefor an egress-only internet gateway: the IPv6 traffic it lets out still pays data transfer out, and no NAT processing.
AWS · Enable outbound IPv6 traffic using an egress-only internet gateway
A NAT gateway also serves IPv6 workloads that talk to IPv4 destinations: "For IPv6 traffic, NAT gateway performs NAT64".
VPC endpoints: AWS services without the internet path
Without an endpoint, the path from a private subnet to an AWS service is the NAT gateway: "Traffic to an AWS service from an instance in a private subnet is routed to a NAT gateway, then to the internet gateway for the VPC, and then to the AWS service. While this traffic traverses the internet gateway, it does not leave the AWS network". Endpoints take that traffic off the NAT gateway, and come in two families (AWS PrivateLink concepts): gateway endpoints, for Amazon S3 and DynamoDB only, and interface endpoints with the other AWS PrivateLink endpoint types; "Gateway endpoints do not use AWS PrivateLink, unlike the other types of VPC endpoints."
A gateway endpoint is a route: "Each subnet route table must have a route that sends traffic destined for the service to the gateway endpoint using the prefix list for the service", and "All instances in the subnets associated with a route table associated with a gateway endpoint automatically use the gateway endpoint to access the service." It is free, "There is no additional charge for using gateway endpoints", and Regional: "Traffic that's destined for the service (Amazon S3 or DynamoDB) in a different Region goes to the internet gateway because prefix lists are specific to a Region." An interface endpoint is a network interface in your subnets: "For each subnet that you specify from your VPC, we create an endpoint network interface in the subnet and assign it a private IP address from the subnet address range", and "You are billed for hourly usage and data processing charges." With private DNS on, the application does not change: "This ensures that requests that use the public service endpoints, such as requests made through an AWS SDK, resolve to your VPC endpoint." In AWS PrivateLink's own words, "You do not need to use an internet gateway, NAT device, public IP address, Direct Connect connection, or AWS Site-to-Site VPN connection to allow communication with the service or resource from your private subnets." The two side by side:
- Charge
- None: no hourly or per-GB charge
- Services
- Amazon S3 and DynamoDB
- What it is
- A route in the subnet's route table, to the service's prefix list
- Reach
- The VPC's own subnets only, in the same Region: not across a VPC peering connection, a transit gateway, a VPN or Direct Connect connection
- Charge
- $0.011 an hour per zone, and $0.01 per GB for the first PB a month
- Services
- Many AWS services, Amazon S3 among them, and your own
- What it is
- A network interface with a private IP address in each subnet you choose, one per zone
- Reach
- Your subnets, and on-premises networks, peered VPCs and transit gateways too
What differs: the charge and the reach. For the VPC's own traffic to S3 or DynamoDB in its Region, the gateway endpoint does the job for nothing.
S3 has both, and one DNS setting decides which bills (Gateway endpoints for Amazon S3): with private DNS on an S3 interface endpoint for every client, "you pay to use the interface endpoint for traffic from the VPC, instead of using the gateway endpoint for no additional charge"; with private DNS only for the inbound Resolver endpoint, "you optimize your costs, because you pay to use the interface endpoint only for traffic that can't use the gateway endpoint." Interface endpoints for S3 "extend the functionality of gateway endpoints by using private IP addresses to route requests to Amazon S3 from within your VPC, on premises, or from a VPC in another AWS Region by using VPC peering or AWS Transit Gateway". Interface endpoints exist for many services (AWS services that integrate with AWS PrivateLink): CloudWatch Logs, Amazon ECR's ecr.api and ecr.dkr, Amazon SQS, AWS STS, AWS KMS and AWS Systems Manager among them, and some reach other Regions: "You can create an interface endpoint to connect to these services in another AWS Region, privately, as if they were running in your own VPC".
Between VPCs: peering, Transit Gateway and shared VPCs
VPC peering has no hourly charge: "There is no charge to create a VPC peering connection. All data transfer over a VPC peering connection that stays within an Availability Zone is free, even if it's between different accounts. Charges apply for data transfer over VPC peering connections that cross Availability Zones and Regions." The whitepaper's VPC peering page calls it the cheapest link, "VPC peering offers the lowest overall cost and highest aggregate performance when compared to other options for inter-VPC connectivity", with its limits: "VPC peering is point-to-point connectivity, and it does not support transitive routing", and "There is a maximum limit of 125 active peering connections per VPC." Against AWS Transit Gateway, the hub, of which the whitepaper says "Typically, you can use just one Transit Gateway instance connecting all your VPC instances in a given Region, and use Transit Gateway routing tables to isolate them wherever needed":
- Charge
- No hourly charge; free in a zone, $0.01 per GB out and $0.01 per GB in across zones
- Routing
- Point to point, with no transitive routing
- Scale
- Up to 125 active peering connections per VPC
- A NAT gateway on the far side
- Not reachable: traffic cannot be routed to a NAT gateway through a peering connection
- Charge
- $0.06 an hour per attachment, and $0.02 per GB sent to it
- Routing
- A hub, with route tables to isolate VPCs where needed
- Scale
- Usually one per Region, for all the VPCs
- A NAT gateway on the far side
- Reachable: centralized egress through an egress VPC
What differs: peering bills only the GB that cross zones; a transit gateway bills every attachment's hours and every GB sent to it, and in exchange routes between all the VPCs.
A transit gateway bills its attachments and its traffic (What is AWS Transit Gateway): "You are charged hourly for each attachment on a transit gateway, and you are charged for the amount of traffic processed on the transit gateway. By default, data processing charges are allocated to the account that owns the source attachment." Its pricing page adds "You will incur standard AWS data transfer charges, in addition to any Transit Gateway charges", and "Data processing charges do not apply for data sent from a peering attachment to a Transit Gateway." Zones crossed inside it are not billed again (How AWS Transit Gateway works): "There is no additional transit gateway charge for this type of cross-Availability Zone traffic."
A shared VPC removes some lines altogether: among the benefits of VPC sharing, "Lower costs — no data transfer charges between instances belonging to different accounts within the same Availability Zone". The participants' resources sit in the subnets the owner shares, and so follow those subnets' route tables: one set of NAT gateways and endpoints can serve several accounts. The whitepaper does not price that last point.
Across zones and Regions: what bills, and in which direction
Between zones, the EC2 pricing page bills data "across Availability Zones in the same AWS Region" in each direction, for EC2, RDS, Redshift, DAX, ElastiCache and network interfaces, and "Data transferred between Amazon EC2, Amazon RDS, Amazon Redshift, Amazon ElastiCache instances, and Elastic Network Interfaces in the same Availability Zone is free." In Paris that rate is $0.01 per GB, so a GB that crosses costs $0.02, computed, and the bill shows it twice: "For a given resource, you're charged for both inbound and outbound traffic in a data transfer within an AWS Region. This means for each resource metered, you'll see two DataTransfer-Regional-Bytes line items for each data transfer". Talking to a neighbour through its public or Elastic IPv4 address pays the same regional rate, even inside one zone. Two instances that talk by private address, in one zone or in two:
- Data between the instances
- Free
- On the bill
- No data transfer line
- Data between the instances
- $0.01 per GB out of one zone, and $0.01 per GB into the other
- On the bill
- Two DataTransfer-Regional-Bytes lines for each transfer
What differs: $0.02 per GB that crosses, computed, before the processing of any service in the path, such as a NAT gateway or a transit gateway.
AWS states the exceptions. An Application Load Balancer and its targets: data "using private IP addresses, between EC2 instances and the load balancer in the same AWS VPC is free" (EC2 pricing), and "With Application Load Balancers, cross-zone load balancing is always enabled at the load balancer level", while "With Network Load Balancers and Gateway Load Balancers, cross-zone load balancing is disabled by default" (How Elastic Load Balancing works). Amazon RDS lists "Data transferred between Availability Zones for replication of Multi-AZ deployments" as free, but "When data transfers between an Amazon EC2 instance and an Amazon RDS database instance in different Availability Zones of the same Region, data transfer charges will apply" (Amazon RDS pricing); the RDS article has the details. And services in the path add their own: "If other AWS services are in the path of your data transfer, you will be charged their associated data processing costs. These services include, but are not limited to, PrivateLink endpoints, NAT Gateway and Transit Gateway".
Between Regions, only the sender pays: "There's no charge for the data transferred into the destination Region. The data transfer charge is determined by the data transferred out from the source Region". An interface endpoint to a service in another Region is the exception: its owner pays the transfer both ways (VPC endpoints in Paris). From Paris, the price list has one rate to 100 of its 103 Region, Local Zone and Wavelength Zone destinations, and more to three:
Data transfer between Paris (eu-west-3) and other Regions
| Item | List price, per GB |
|---|---|
| To Frankfurt (eu-central-1)The rate to 100 of the 103 destinations | $0.02 |
| To Ireland (eu-west-1) | $0.02 |
| To US East (N. Virginia) | $0.02 |
| To Canada West (Calgary)And to Mexico (Central) | $0.05 |
| To Asia Pacific (Thailand) | $0.08 |
| Into Paris, from FrankfurtEvery Region into Paris | $0.00 |
USD, before tax. AWS Price List, eu-west-3, offer file published September 16, 2026, fetched October 16, 2026.
Well-Architected's advice is in COST08-BP02: "It should be a very thoughtful decision to pursue a multi-Region path."
Out to the internet: the tiers, the free 100 GB, and CloudFront
Data transfer out of Paris to the internet is tiered by the month, from $0.09 per GB for the first 10 TB down to $0.05 beyond 150 TB, and data in from the internet is free. The tiers count every service together (EC2 pricing): "Rate tiers take into account your aggregate usage for Data Transfer Out to the Internet across" Amazon EC2, Amazon S3, Amazon RDS and eleven other services, Amazon CloudWatch Logs among them. So does the free allowance: "AWS customers receive 100 GB of free data transfer out to the internet free each month, aggregated across all AWS Services and Regions (except China and GovCloud)." The same page has two European statements without a price: "EU customers may request reduced data transfer rates for eligible use cases under the European Data Act. Please contact AWS Customer Support for more information", and "AWS also offers eligible customers free data transfer out to the internet when they move all of their data off of AWS or all of their data off of a particular AWS service."
Amazon CloudFront changes the path. From an AWS origin, the transfer to CloudFront is free: "if you are using an AWS origin (e.g., Amazon S3, Amazon EC2, etc.), we no longer charge for AWS data transfer out to Amazon CloudFront" (CloudFront FAQs), and the S3 pricing page lists "Data transferred out to Amazon CloudFront (CloudFront)." among its free transfers. CloudFront then bills its own data transfer out, by edge location, and serves repeated requests from its caches (How CloudFront delivers content): "CloudFront checks its cache for the requested object. If the object is in the cache, CloudFront returns it to the user." Its prices are in CloudFront in front.
What NAT gateways are used for
The use cases AWS lists each bill a different way:
Use cases AWS lists for NAT gateways, and what each one means for the bill
| Use case, in AWS's words | What it means for the bill |
|---|---|
| "You can use a public NAT gateway to enable instances in a private subnet to send outbound traffic to the internet, while preventing the internet from establishing connections to the instances." | Hours per gateway, every GB processed, and data transfer out |
| "many apps will require outbound-only internet access (for example, downloading libraries, patches, or OS updates)." | Mostly downloads: free as data transfer in, billed as NAT processing |
| A private NAT gateway, "using a pool of allow-listed addresses" to an on-premises network | The same NAT gateway rows, with no Elastic IP address |
| A private NAT gateway between networks "even if they have overlapping CIDR ranges" | The same rows, and the transit gateway or virtual private gateway's own charges |
| Centralized egress for many VPCs through a transit gateway | Fewer NAT gateways, and Transit Gateway processing on every GB: pattern 3 |
| IPv6 workloads that reach IPv4 services, with NAT64 and DNS64 | NAT processing for that traffic |
The first, third and fourth rows quote NAT gateway use cases, the second the whitepaper's Centralized egress to internet. A NAT gateway is also what reaches AWS services from a private subnet when no endpoint does: container image pulls, calls to AWS APIs, logs. The EKS article prices image pulls through one.
NAT gateway or NAT instance?
A NAT instance is an EC2 instance that does the translation, and AWS's answer is in its NAT devices page:
We recommend that you use NAT gateways because they provide better availability and bandwidth and require less effort on your part to administer.
The NAT instances page adds that the "NAT AMI is built on the last version of the Amazon Linux AMI, 2018.03, which reached the end of standard support on December 31, 2020 and end of maintenance support on December 31, 2023", and "If you use an existing NAT AMI, AWS recommends that you migrate to a NAT gateway". AWS's comparison prices the two differently: a NAT gateway is "Charged depending on the number of NAT gateways you use, duration of usage, and amount of data that you send through the NAT gateways", a NAT instance "Charged depending on the number of NAT instances that you use, duration of usage, and instance type and size." Its other rows, availability, bandwidth, maintenance, security groups, are why this article gives NAT instances no lever: the levers below keep AWS's recommendation and cut the NAT gateway's traffic instead.
How NAT gateway and data transfer pricing works
What the bill is made of
The lines of the bill around a VPC's traffic come from several services, and only one of them has a commitment discount: the Amazon VPC, AWS Data Transfer and Amazon CloudFront offers have On-Demand terms only in the AWS Price List, and so do the NAT gateway rows of the Amazon EC2 offer; CloudFront's Security Savings Bundle, outside the price list, is the one commitment (Commit only where AWS offers a commitment).
The lines of a NAT gateway and data transfer bill, and the service that bills each
| Line | Billed by | Charged for |
|---|---|---|
| NAT gateways | Amazon EC2 (EC2 - Other in Cost Explorer) | Each hour per zonal gateway or per zone of a regional one, every GB processed |
| Public IPv4 addresses | Amazon VPC | Each hour, in use or idle |
| Interface endpoints | Amazon VPC | Each hour per endpoint and zone, every GB processed |
| Gateway endpoints | Nobody | Nothing |
| Transit Gateway | Amazon VPC | Each attachment-hour, every GB sent to it |
| VPC peering | Amazon VPC | Nothing in a zone; each GB across zones, both ways |
| Data transfer | AWS Data Transfer | Between zones, both ways; out to other Regions; out to the internet, by tier |
| CloudFront | Amazon CloudFront | Data out by edge location, requests, data to the origin; or a flat-rate plan |
| VPC Flow Logs | Amazon CloudWatch | Vended logs, per GB |
The NAT gateway rows live in the Amazon EC2 offer, not in Amazon VPC's, which is why Cost Explorer shows them as an EC2 cost (Reading the lines of a bill). Put together, this is the NAT month of an illustrative small VPC: three public NAT gateways with one Elastic IP address each, and 1 TB a month through them, none of it crossing a zone. Data transfer out to the internet and VPC endpoints are not counted:
A NAT gateway in each of three zones, all month in Paris, and 1 TB processed (illustrative)
| Line | A month, computed |
|---|---|
| Three NAT gateways, 3 × 730 h2,190 h × $0.05 /h | $109.50 |
| Their Elastic IP addresses, 3 × 730 h2,190 h × $0.005 /h | $10.95 |
| Data processed, 1 TB1,024 GB × $0.05 /GB | $51.20 |
| Total | $171.65 |
USD, before tax. AWS Price List, eu-west-3, offer files published September 17, 2026 and October 15, 2026, fetched October 16, 2026.
NAT gateways in Paris
The NAT gateway lines, zonal and regional, and the address a public one needs:
NAT gateways and public IPv4 addresses in Paris (eu-west-3)
| Item | List price | Unit |
|---|---|---|
| Zonal NAT gateway | ||
| NAT gatewayPer gateway, each partial hour billed as a full hour | $0.05 | per hour |
| Data processedEach GB, in either direction | $0.05 | per GB |
| Regional NAT gateway | ||
| NAT gatewayPer zone it is configured in | $0.05 | per hour |
| Data processedEach GB, in either direction | $0.05 | per GB |
| Public IPv4 addresses | ||
| In useThe Elastic IP address of a public NAT gateway | $0.005 | per hour |
| IdleAllocated to the account, not used | $0.005 | per hour |
USD, before tax. AWS Price List, eu-west-3, offer files published September 17, 2026 and October 15, 2026, fetched October 16, 2026.
So one zonal NAT gateway with its Elastic IP address costs $40.15 a month before it processes a byte, and one in each of three zones $120.45, computed. The processing then follows every GB, whichever way it goes:
Every TB through a NAT gateway
$51.20 a monthof data processing in Paris, uploads and downloads alike, on top of the gateway's hours and of any data transfer out, computed.
Computed from the AWS Price List · eu-west-3 · Oct 15, 2026
A GB sent to the internet through a NAT gateway costs $0.14 with the first tier of data transfer out, and $0.16 from an instance in another zone, computed. A GB to Amazon S3 through a NAT gateway costs $0.05, and $0.07 through one in another zone; through a gateway endpoint, nothing.
What one GB costs, path by path
The same GB costs nothing, or up to $0.16, depending on the path it takes. Each row adds the list prices that its path bills:
What one GB costs in Paris, path by path (computed from list prices)
| Path of one GB | What bills | Per GB, computed |
|---|---|---|
| To an instance in the same zone, by private address | Nothing | $0.00 |
| To Amazon S3 in the Region, through a gateway endpoint | Nothing | $0.00 |
| To an AWS service, through an interface endpoint | Endpoint processing | $0.01 |
| To an instance in another zone | Cross-zone, out and in | $0.02 |
| To another VPC in the same zone, through a transit gateway | Transit Gateway processing | $0.02 |
| To Frankfurt (eu-central-1) | Inter-Region out | $0.02 |
| To Amazon S3, through a NAT gateway | NAT processing | $0.05 |
| To Amazon S3, through a NAT gateway in another zone | Cross-zone, out and in + NAT processing | $0.07 |
| To users in Europe, through CloudFront | Origin to CloudFront (free) + CloudFront out, first 10 TB; requests billed on top | $0.085 |
| To the internet, from a public subnet | Data out, first 10 TB | $0.09 |
| To the internet, through a NAT gateway | NAT processing + data out, first 10 TB | $0.14 |
| To the internet, through a NAT gateway in another zone | Cross-zone, out and in + NAT processing + data out, first 10 TB | $0.16 |
| To the internet, through a transit gateway and a central NAT gateway | Transit Gateway processing + NAT processing + data out, first 10 TB | $0.16 |
Computed from the AWS Price List, eu-west-3 and Europe edge locations, offer files published September 16, 2026, September 17, 2026, October 3, 2026 and October 15, 2026, fetched October 16, 2026.
The internet rows use the first tier of data transfer out; the CloudFront row its first tier at its Europe edge locations, before its requests. The rows with a NAT gateway are the dearest of their kind: the same GB to Amazon S3 costs nothing through a gateway endpoint and $0.05 through a NAT gateway, and a GB to the internet costs $0.09 from a public subnet and $0.14 through a NAT gateway.
VPC endpoints in Paris
Gateway endpoints have no row in the price list, because they have no charge. Interface endpoints and the other AWS PrivateLink endpoint types do:
VPC endpoints in Paris (eu-west-3)
| Item | List price | Unit |
|---|---|---|
| Interface endpoints (AWS PrivateLink) | ||
| Interface endpointPer endpoint and zone | $0.011 | per hour |
| Data processedFirst PB a month, all the Region's interface endpoints together | $0.01 | per GB |
| Data processedFrom 1 PB to 5 PB a month | $0.006 | per GB |
| Data processedBeyond 5 PB a month | $0.004 | per GB |
| Other endpoint types | ||
| Gateway Load Balancer endpointPer endpoint and zone | $0.011 | per hour |
| Its data processed | $0.0035 | per GB |
| Resource endpointPer VPC resource | $0.022 | per hour |
| Cross-Region endpoint serviceProvider side, per active remote Region | $0.05 | per hour |
USD, before tax. AWS Price List, eu-west-3, offer file published September 17, 2026, fetched October 16, 2026.
The PrivateLink pricing page sets the basis: "You will be billed for each hour that your VPC endpoint remains provisioned in each Availability Zone, irrespective of the state of its association with the service", and "Data processing charges apply for each Gigabyte processed through the VPC endpoint regardless of the traffic’s source or destination." Its tiers, "Below pricing tiers apply on the total data processed by all Interface Endpoints in an AWS Region", are for the Region, not per endpoint. Some services pay for their own: "Some AWS services may optionally include the cost of interface VPC endpoints associated with their service in the cost of their service, and you may not see these costs directly identified in your bill." And for an endpoint to another Region, "There is no premium for accessing a service in another region. You incur standard PrivateLink charges for data processing and hours. In addition, AWS cross-region data transfer rates will apply." The same page says who pays them, "The Interface endpoint owner will be charged for each Gigabyte transferred inter-region regardless of the directionality of the data transfer": an exception to the rule that only the sender pays between Regions. One endpoint in three zones costs this before its traffic:
One interface endpoint in three zones
$24.09 a monthin Paris, 730 hours in each zone, computed: billed from creation, used or not, and per service, since each endpoint serves one.
Computed from the AWS Price List · eu-west-3 · Sep 17, 2026
Against the NAT gateway it replaces for one AWS service, an interface endpoint saves $0.04 per GB and costs $8.03 a month per zone, computed: it pays for itself above 401.50 GB a month in two zones and 602.25 GB in three. Below that, the NAT path costs less for that service, as long as the NAT gateways stay for other traffic anyway. A gateway endpoint has no break-even: it is free.
Data transfer in Paris
The data transfer rows in the Region and to the internet, from the AWS Data Transfer offer; the rows to other Regions are in Across zones and Regions:
Data transfer in Paris (eu-west-3), and out to the internet and CloudFront
| Item | List price, per GB |
|---|---|
| In the Region | |
| In from the internet | $0.00 |
| Between zonesOut of one zone, and again into the other; also through public or Elastic IPv4 addresses | $0.01 |
| From Paris to the internet | |
| First 10 TB a monthAcross services, before the 100 GB free | $0.09 |
| Next 40 TB | $0.085 |
| Next 100 TB | $0.07 |
| Over 150 TB | $0.05 |
| To CloudFront | |
| To Amazon CloudFrontFrom an AWS origin | $0.00 |
USD, before tax. AWS Price List, eu-west-3, offer file published September 16, 2026, fetched October 16, 2026.
The price list also has two rows for traffic between zones at no charge (EUW3-DataTransfer-xAZ-In-Bytes and -Out-Bytes), beside the regional row; the EC2 pricing page states the regional rate in each direction, and this article uses it. The S3 article prices the same rows for S3's traffic.
Transit Gateway and VPC peering in Paris
Between VPCs, the attachments bill by the hour and the GB by the sender:
AWS Transit Gateway and VPC peering in Paris (eu-west-3)
| Item | List price | Unit |
|---|---|---|
| AWS Transit Gateway | ||
| VPC attachmentBilled to the VPC owner, each partial hour as a full hour | $0.06 | per hour |
| Data processedEach GB sent to it from a VPC attachment | $0.02 | per GB |
| Peering attachment | $0.06 | per hour |
| VPC peering | ||
| Across zones, out | $0.01 | per GB |
| Across zones, in | $0.01 | per GB |
| Between Regions, out | $0.02 | per GB |
USD, before tax. AWS Price List, eu-west-3, offer files published September 16, 2026 and September 17, 2026, fetched October 16, 2026.
An attachment costs $43.80 a month, computed, and "The VPC account owner is billed hourly for each hour that their Amazon VPCs are attached to an AWS Transit Gateway" (Transit Gateway pricing). The processing is billed "to the VPC owner who sends the traffic to Transit Gateway", so a request through a transit gateway is processed once on its way there, and its response once on its way back, each by its sender.
CloudFront in front: pay-as-you-go or a flat-rate plan
CloudFront bills what it sends, "You are charged for the volume of data transferred out from Amazon CloudFront edge locations, measured in GB", by tier, from $0.085 per GB for the first 10 TB a month at its Europe edge locations down to $0.02 beyond 5 PB. On the tiers that line up with Paris's internet egress, it costs less per GB on every one:
CloudFront also bills what direct egress does not: $0.012 per 10,000 requests for HTTPS and $0.009 per 10,000 requests for HTTP, and data sent back to the origin, $0.02 per GB: "You will be charged for the volume of data transferred out, measured in GB, from the Amazon CloudFront edge locations to your origin (both AWS origins and other origin servers)" (CloudFront FAQs). Its free tier "applies only to CloudFront usage under pay-as-you-go pricing", one per organization, and this article does not deduct it. Price classes are the other pay-as-you-go setting: "Price Classes let you reduce your delivery prices by excluding Amazon CloudFront’s more expensive edge locations from your Amazon CloudFront distribution." The flat-rate plans are the other way to pay: "CloudFront flat-rate pricing plans combine the Amazon CloudFront global content delivery network (CDN) with multiple AWS services and features into a monthly price with no overage charges, regardless of traffic spikes or attacks." The two side by side:
- Price
- $0.085 per GB for the first 10 TB a month in Europe, less beyond, and $0.012 per 10,000 HTTPS requests
- Allowance
- None: every GB and every request is billed
- Conditions
- None
- Free tier
- 1 TB and 10 million requests a month, one per organization
- Security Savings Bundle
- Up to 30% for a one-year commitment
- Price
- One monthly price per distribution: Pro $15.00, Business $200.00, Premium from $1,000.00
- Allowance
- Pro 10 million requests and 50 TB a month, Business 125 million and 50 TB, Premium 500 million and 50 TB by default
- Conditions
- One distribution, one apex domain, an AWS WAF web ACL, no unsupported feature
- Free tier
- A Free plan: 1 million requests and 100 GB a month
- Security Savings Bundle
- Does not apply
What differs: a price that follows every GB and every request, against one monthly price with allowances and conditions.
The plans' conditions, in AWS's words: "Each pricing plan covers one CloudFront distribution with up to one apex (root) domain"; "You must have a AWS WAF Web ACL associated with your distribution if you're using a pricing plan."; the allowances "are not hard limits", but "If you continue to substantially exceed your plan's usage allowance without upgrading, your traffic delivery might be adjusted." AWS also says when not to use them: "Pay-as-you-go pricing is a better choice if you need complete control over individual service features, custom configurations, access to features not available in flat-rate plans, or if you expect to handle large, predictable traffic spikes." The CloudFront pricing page adds: "Data transfer between CloudFront and your AWS origins is automatically waived when serving traffic through CloudFront".
VPC Flow Logs and the NAT gateway's metrics
Seeing the traffic has a price too. "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC", "Flow log data is collected outside of the path of your network traffic, and therefore does not affect network throughput or latency", and "Data ingestion and archival charges for vended logs apply when you publish flow logs." In Paris, flow logs cost $0.5985 per GB delivered to CloudWatch Logs and $0.25 per GB delivered to Amazon S3, for the first 10 TB a month:
100 GB of flow logs into CloudWatch Logs
$59.85 a monthin Paris, computed, before storage: flow logs bill by the GB they write, so their scope sets their cost.
Computed from the AWS Price List · eu-west-3 · Oct 7, 2026
Delivered to Amazon S3, the same 100 GB cost $25.00 a month, computed. The NAT gateway's own CloudWatch metrics, BytesOutToDestination and BytesInFromDestination among them, give the volume its processing line bills.
Reading the NAT gateway and data transfer lines of a bill
Each line has its usage type, with the Region's code, EUW3- in Paris. From the Paris price list:
NAT gateway and data transfer usage types on a bill in Paris
| Usage type | What it counts |
|---|---|
EUW3-NatGateway-Hours, EUW3-NatGateway-Bytes |
Zonal NAT gateways, hours and GB processed, under Amazon EC2 |
EUW3-RegionalNatGateway-Hours, EUW3-RegionalNatGateway-Bytes |
Regional NAT gateways, zone-hours and GB processed, under Amazon EC2 |
EUW3-PublicIPv4:InUseAddress, EUW3-PublicIPv4:IdleAddress |
Public IPv4 addresses, under Amazon VPC |
EUW3-VpcEndpoint-Hours, EUW3-VpcEndpoint-Bytes |
Interface endpoints, under Amazon VPC |
EUW3-TransitGateway-Hours, EUW3-TransitGateway-Bytes |
Transit gateway attachments and processing, under Amazon VPC |
EUW3-DataTransfer-Regional-Bytes |
Between zones, both directions |
EUW3-DataTransfer-Out-Bytes |
Out to the internet |
EUW3-EUC1-AWS-Out-Bytes |
Out to another Region, here Frankfurt |
EUW3-CloudFront-Out-Bytes |
Out to CloudFront, at no charge from an AWS origin |
EU-DataTransfer-Out-Bytes, EU-Requests-Tier2-HTTPS |
CloudFront's data out and HTTPS requests at its Europe edge locations, under Amazon CloudFront |
The rules for reading them are in Understanding data transfer charges: "You can identify your AWS data transfer charges using the lineItem/UsageType column of your AWS CUR"; "Use the lineItem/ProductCode column to distinguish CloudFront data transfer from data transfer out to the internet. The usage types for these data transfer types look similar."; and usage types without a Region prefix, such as DataTransfer-Out-Bytes, are US East (N. Virginia)'s. The CUR's product/fromLocation "Describes the location where the usage originated from." (Product details), and product/toLocation says where the GB went.
The invoice and Cost Explorer group these lines differently (Billing and Cost Explorer data): "Instead of a single group for Amazon EC2 costs, Cost Explorer will group costs into EC2 - Instances and EC2 - Other", the second for "ancillary cost, such as Amazon Elastic Block Store volumes or NAT gateways", and "In billing data, data transfer costs are grouped into a single service named Data Transfer", while "Cost Explorer groups your transfer costs by service." Its usage type groups name the lines: "EC2: NAT Gateway - Data Processed" ("Filters by the costs associated with how many GB that your network address translation gateways (NAT gateways) processed."), "EC2: NAT Gateway - Running Hours", "EC2: Data Transfer - Inter AZ", "EC2: Data Transfer - Internet (Out)", "EC2: Data Transfer - Region to Region (Out)" and "EC2: Data Transfer - CloudFront (Out)". The EC2 article's FAQ explains EC2 - Other, and the VPC lines have their own codes (billing and usage reports): region-VpcEndpoint-Hours, "The time that interface VPC endpoints are provisioned.", and region-TransitGateway-Bytes, "The data processed by transit gateways."
In short: A NAT gateway bills its hours and every GB it processes, in both directions, and the data transfer behind it bills again: the route a GB takes sets its price, from nothing through a gateway endpoint to $0.16 to the internet through a NAT gateway in another zone, computed.
Architecture patterns around NAT gateways and data transfer, and what they cost
Four illustrative configurations in Paris, each priced before and after the levers of the next section, line by line from the AWS Price List: AWS service traffic paying NAT processing, zones crossed on the way to a NAT gateway, NAT gateways multiplied across VPCs, and internet traffic that a CDN could carry. None is a client case; every amount is computed, and each card lists its assumptions and what it leaves out. The EC2 patterns price the compute side of an application the same way.
Pattern 1 of 4 · Illustrative configuration
Private subnets that reach S3 and CloudWatch Logs through NAT gateways
A data-processing workload in the private subnets of three zones reads 20 TB a month from Amazon S3, sends 3 TB of logs to CloudWatch Logs and exchanges 1 TB with the internet, all through a NAT gateway in each zone; then S3 through a gateway endpoint and the logs through an interface endpoint, the NAT gateways kept for the internet.
- Every GB to S3, to CloudWatch Logs and to the internet is processed by a NAT gateway, $0.05 per GB in either direction, on top of $0.05 an hour for each of the three gateways, one per zone.
- A gateway endpoint for S3: a route in the route tables of the private subnets, with no hourly or per-GB charge. S3 to EC2 in the same Region is free.
- An interface endpoint for CloudWatch Logs in each of the three zones: $0.011 an hour per zone and $0.01 per GB. Against the NAT gateway's $0.05, it pays for itself above 602.25 GB a month, computed.
- The NAT gateways now carry the internet traffic only.
The S3 reads alone were $1,024.00 of the bill before, 74.9%, computed, all of it NAT processing for traffic whose transfer was free. An S3 interface endpoint in the three zones instead of the gateway endpoint would bring the bill to $473.35 a month, computed: it is the one to use only for traffic that cannot take the gateway endpoint.
With the levers: $1,122.79 a month less (82.1% less), computed.
The bills line by line, the assumptions and the sources
Private subnets that reach S3 and CloudWatch Logs through NAT gateways, before: Everything through the NAT gateways Illustrative
Three NAT gateways, one per zone, process the S3 reads, the logs and the internet traffic.
| Line | A month |
|---|---|
| Network | $1,367.25 |
| NAT gateways, one per zone3 NAT gateways × 730 h × $0.05 /h | $109.50 |
| Their Elastic IP addresses (public IPv4), one each3 addresses × 730 h × $0.005 /h | $10.95 |
| NAT processing, S3 reads20,480 GB × $0.05 /GB | $1,024.00 |
| NAT processing, CloudWatch Logs3,072 GB × $0.05 /GB | $153.60 |
| NAT processing, internet traffic1,024 GB × $0.05 /GB | $51.20 |
| Data transfer out to the internet, first 10 TB tier200 GB × $0.09 /GB | $18.00 |
| A month, computed | $1,367.25 |
Private subnets that reach S3 and CloudWatch Logs through NAT gateways, with the levers: S3 through a gateway endpoint, logs through an interface endpoint Illustrative
A gateway endpoint for S3 in the private route tables, an interface endpoint for CloudWatch Logs in the three zones; the NAT gateways carry the internet traffic only.
| Line | A month |
|---|---|
| Network | $244.46 |
| NAT gateways, one per zone3 NAT gateways × 730 h × $0.05 /h | $109.50 |
| Their Elastic IP addresses (public IPv4), one each3 addresses × 730 h × $0.005 /h | $10.95 |
| Interface endpoint for CloudWatch Logs, in the three zones3 zones × 730 h × $0.011 /h | $24.09 |
| Interface endpoint processing, CloudWatch Logs3,072 GB × $0.01 /GB | $30.72 |
| NAT processing, internet traffic1,024 GB × $0.05 /GB | $51.20 |
| Data transfer out to the internet, first 10 TB tier200 GB × $0.09 /GB | $18.00 |
| A month, computed | $244.46 |
An S3 interface endpoint instead of the gateway endpoint: $473.35 a month, 65.4% less than before, computed.
Assumptions
- Illustrative configuration in Paris (eu-west-3), not a client case.
- 20,480 GB (20 TB) of S3 reads, 3,072 GB (3 TB) to CloudWatch Logs and 1,024 GB (1 TB) exchanged with the internet a month (packages, third-party APIs), of which 200 GB go out; all illustrative.
- A public NAT gateway in each of the three zones, each with one Elastic IP address, and every private subnet routes to the NAT gateway of its own zone, so no traffic crosses a zone in either variant.
- The buckets are in Paris: a gateway endpoint reaches S3 in its own Region only.
- The interface endpoint for CloudWatch Logs has a network interface in each of the three zones and private DNS on, so the SDK's calls to the public service name reach it. Its per-GB price is the first tier: all the interface endpoints of the Region process far less than 1 PB a month.
Not counted
- CloudWatch Logs' own ingestion and storage, and S3 request charges: the same in both variants.
- The 100 GB a month of free data transfer out, not deducted.
Sources
- Pricing for NAT gateways
- Gateway endpoints
- Gateway endpoints for Amazon S3
- Access AWS services through AWS PrivateLink
- Access an AWS service using an interface VPC endpoint
- AWS PrivateLink pricing
- Amazon VPC pricing
USD before tax, 730 h a month. AWS Price List, eu-west-3, offer files published September 16, 2026, September 17, 2026 and October 15, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.
Pattern 2 of 4 · Illustrative configuration
One NAT gateway for three zones
A VPC in three zones sends 12 TB a month through NAT to the internet and third-party APIs, a third from each zone, once its AWS service traffic has moved to endpoints. To save gateways, only zone 1 has a NAT gateway; then a NAT gateway in each zone.
- One NAT gateway, in zone 1: $0.05 an hour and $0.05 per GB. If zone 1 is down, the instances of the other zones lose internet access.
- The instances of zones 2 and 3 reach it across zones: each GB, out and back, is billed $0.01 out of one zone and $0.01 into the other, on top of the NAT gateway's $0.05.
- A NAT gateway in each zone, or a regional NAT gateway, keeps each zone's traffic in its zone: two more zones at $0.05 an hour each, against the cross-zone GB they remove.
The cross-zone lines cost $163.84 a month before, computed, against $80.30 for the two more NAT gateways and their addresses: one NAT gateway per zone costs less above 6,022.50 GB a month through NAT, about 5.9 TB, of which 4,015 GB cross a zone, computed. Below it, one shared gateway costs less, and its zone stays a single point of failure for the others. A regional NAT gateway in the three zones bills $734.85, the same as three zonal ones, with no public subnet to run.
With the levers: $83.54 a month less (10.2% less), computed.
The bills line by line, the assumptions and the sources
One NAT gateway for three zones, before: One NAT gateway in zone 1 for all three zones Illustrative
One NAT gateway with its Elastic IP address; zones 2 and 3 reach it across zones.
| Line | A month |
|---|---|
| Network | $818.39 |
| NAT gateway, in zone 11 NAT gateway × 730 h × $0.05 /h | $36.50 |
| Its Elastic IP address (public IPv4)1 address × 730 h × $0.005 /h | $3.65 |
| NAT processing12,288 GB × $0.05 /GB | $614.40 |
| Zones 2 and 3 to the NAT gateway and back: 8,192 GB out of their zone8,192 GB × $0.01 /GB | $81.92 |
| The same 8,192 GB into the other zone8,192 GB × $0.01 /GB | $81.92 |
| A month, computed | $818.39 |
One NAT gateway for three zones, with the levers: A NAT gateway in each zone Illustrative
Three NAT gateways, each with its Elastic IP address; each zone's traffic stays in its zone.
| Line | A month |
|---|---|
| Network | $734.85 |
| NAT gateways, one per zone3 NAT gateways × 730 h × $0.05 /h | $109.50 |
| Their Elastic IP addresses (public IPv4), one each3 addresses × 730 h × $0.005 /h | $10.95 |
| NAT processing12,288 GB × $0.05 /GB | $614.40 |
| A month, computed | $734.85 |
A regional NAT gateway instead: $734.85 a month, 10.2% less than before, computed.
Assumptions
- Illustrative configuration in Paris (eu-west-3), not a client case.
- 12,288 GB (12 TB) a month processed by NAT, illustrative, evenly spread over the three zones.
- Before: the private subnets of zones 2 and 3 route to the NAT gateway of zone 1, so two thirds of the traffic, 8,192 GB, crosses a zone exactly once on its way (requests out, responses back), billed out of one zone and into the other.
- After: a NAT gateway in each zone, and each private subnet routes to the gateway of its own zone. Each zone also keeps its internet access when another zone is down.
- A regional NAT gateway instead: configured in the three zones, billed per zone-hour at its own rate, with one public IPv4 address per zone, which AWS's page on regional NAT gateways does not confirm for automatic mode.
Not counted
- Data transfer out to the internet, the same in both variants, and the 100 GB a month free, not deducted.
- The up to 60 minutes a regional NAT gateway may take to expand to a new zone, while that zone's traffic is processed across zones.
Sources
- NAT gateway basics
- Pricing for NAT gateways
- Regional NAT gateways for automatic multi-AZ expansion
- COST08-BP02 Select components to optimize data transfer cost
- Understanding data transfer charges
- Amazon EC2 On-Demand Pricing
- Amazon VPC pricing
USD before tax, 730 h a month. AWS Price List, eu-west-3, offer files published September 16, 2026, September 17, 2026 and October 15, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.
Pattern 3 of 4 · Illustrative configuration
Twelve spoke VPCs, each with its own NAT gateways
Twelve application VPCs in Paris, one per account, each with a NAT gateway in each of its three zones and about 300 GB a month through NAT, all already attached to a transit gateway; then one egress VPC behind the transit gateway, with a NAT gateway per zone for all of them.
- Twelve spoke VPCs, each attached to the transit gateway for traffic between VPCs: $0.06 an hour per attachment. Before, each spoke also had a NAT gateway in each of its three zones.
- Internet traffic from the spokes crosses the transit gateway to the egress VPC: $0.02 per GB sent to it, by the spoke on the way out and by the egress VPC on the way back.
- Three NAT gateways for all the spokes, one per zone, at $0.05 an hour each. The NAT gateway's $0.05 per GB does not change.
The 36 NAT gateways and their addresses carried most of the bill before; after, every GB pays Transit Gateway processing on top of NAT processing. That is the whitepaper's caveat, in its words: "In some edge cases when you send huge amounts of data through NAT gateway from a VPC, keeping the NAT local in the VPC to avoid the Transit Gateway data processing charge might be a more cost-effective option." Per spoke, its own three NAT gateways cost $120.45 a month, computed, so a spoke that sends more than 6,022.50 GB a month through NAT pays less on its own, and 3,832.50 GB if it is not yet attached to a transit gateway.
With the levers: $1,209.15 a month less (56.2% less), computed.
The bills line by line, the assumptions and the sources
Twelve spoke VPCs, each with its own NAT gateways, before: A NAT gateway per zone in every spoke VPC Illustrative
36 NAT gateways, three in each spoke VPC, each with its Elastic IP address.
| Line | A month |
|---|---|
| Network | $2,151.00 |
| NAT gateways, one per zone in each of the twelve spoke VPCs36 NAT gateways × 730 h × $0.05 /h | $1,314.00 |
| Their Elastic IP addresses (public IPv4), one each36 addresses × 730 h × $0.005 /h | $131.40 |
| NAT processing3,600 GB × $0.05 /GB | $180.00 |
| Transit gateway attachments of the twelve spoke VPCs12 attachments × 730 h × $0.06 /h | $525.60 |
| A month, computed | $2,151.00 |
Twelve spoke VPCs, each with its own NAT gateways, with the levers: One egress VPC behind the transit gateway Illustrative
An egress VPC with three NAT gateways and its own attachment; the spokes keep no NAT gateway.
| Line | A month |
|---|---|
| Network | $941.85 |
| NAT gateways in the egress VPC, one per zone3 NAT gateways × 730 h × $0.05 /h | $109.50 |
| Their Elastic IP addresses (public IPv4), one each3 addresses × 730 h × $0.005 /h | $10.95 |
| NAT processing3,600 GB × $0.05 /GB | $180.00 |
| Transit gateway attachments of the twelve spoke VPCs12 attachments × 730 h × $0.06 /h | $525.60 |
| Transit gateway attachment of the egress VPC1 attachment × 730 h × $0.06 /h | $43.80 |
| Transit Gateway processing of the internet traffic3,600 GB × $0.02 /GB | $72.00 |
| A month, computed | $941.85 |
Assumptions
- Illustrative configuration in Paris (eu-west-3), not a client case.
- Twelve spoke VPCs in three zones, each sending and receiving about 300 GB a month through NAT (updates, third-party APIs): 3,600 GB in all, illustrative.
- The spokes are attached to the transit gateway in both variants, for their traffic between VPCs and to the on-premises network, so their attachments are on both bills.
- After: the spokes route 0.0.0.0/0 to the transit gateway, which sends it to an egress VPC with a NAT gateway in each zone and its own attachment. Each GB through NAT is processed by the transit gateway once: by the spoke's attachment on the way out, by the egress VPC's on the way back (the sender pays).
- Traffic keeps to its zone through the transit gateway and the egress VPC; three NAT gateways have the capacity (each scales to 100 Gbps).
Not counted
- Data transfer out to the internet, the same in both variants, and the 100 GB a month free, not deducted.
- Network Firewall or other inspection, the route tables and DNS work, and the transit gateway's other attachments.
Sources
- Centralized egress to internet
- Using the NAT gateway for centralized IPv4 egress
- How AWS Transit Gateway works
- AWS Transit Gateway pricing
- Cost optimization (AWS Trusted Advisor checks)
- NAT gateway basics
USD before tax, 730 h a month. AWS Price List, eu-west-3, offer files published September 17, 2026 and October 15, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.
Pattern 4 of 4 · Illustrative configuration
Public downloads served straight from Paris
A download service in Paris, instances behind an Application Load Balancer, serves 40 TB a month to users in Europe in responses of 1 MB on average: straight to the internet, then through a CloudFront distribution whose origin is the load balancer.
- Before (dashed): the responses go straight to the internet, billed as data transfer out of Paris: $0.09 per GB for the first 10 TB a month, $0.085 for the next 40 TB.
- From an AWS origin to CloudFront, data transfer is free: $0.00 per GB.
- CloudFront bills its own data transfer out from its European edge locations, $0.085 then $0.08 per GB, and $0.012 per 10,000 HTTPS requests; a flat-rate plan replaces both with one monthly price, $200.00 for the Business plan.
- Requests served from CloudFront's caches never reach the origin: fewer requests for the load balancer and the instances (not counted in this pattern).
The per-GB saving at 40 TB is $204.80 a month, computed, and the 41,943,040 HTTPS requests of 1 MB responses take $50.33 of it: below an average response of about 252 KB, the requests would cost more than the saving. On the Business flat-rate plan, the same month costs $200.00, 94.3% less than straight from Paris, computed, if the distribution meets the plan's conditions; the Pro plan's 10 million requests a month would not cover this traffic.
With the levers: $154.47 a month less (4.4% less), computed.
The bills line by line, the assumptions and the sources
Public downloads served straight from Paris, before: Straight from Paris to the internet Illustrative
The load balancer's responses go out of Paris to the internet, on its tiers.
| Line | A month |
|---|---|
| Network | $3,532.80 |
| Out to the internet from Paris, first 10 TB10,240 GB × $0.09 /GB | $921.60 |
| Out to the internet from Paris, next 40 TB30,720 GB × $0.085 /GB | $2,611.20 |
| A month, computed | $3,532.80 |
Public downloads served straight from Paris, with the levers: Through CloudFront, pay-as-you-go Illustrative
A CloudFront distribution in front of the load balancer, at its Europe rates per GB and per 10,000 HTTPS requests.
| Line | A month |
|---|---|
| Network | $3,378.33 |
| Origin to CloudFront40,960 GB × $0.00 /GB | $0.00 |
| CloudFront out from its Europe edge locations, first 10 TB10,240 GB × $0.085 /GB | $870.40 |
| CloudFront out from its Europe edge locations, next 40 TB30,720 GB × $0.08 /GB | $2,457.60 |
| CloudFront HTTPS requests41,943,040 requests × $0.012 /10K req | $50.33 |
| A month, computed | $3,378.33 |
The CloudFront Business flat-rate plan instead: $200.00 a month, 94.3% less than before, computed.
Assumptions
- Illustrative configuration in Paris (eu-west-3), not a client case.
- 40,960 GB (40 TB) a month delivered to viewers in Europe in both variants, every response over HTTPS, 1 MB on average: 41,943,040 requests a month, computed. All illustrative.
- CloudFront is priced at its Europe edge-location rates, and cache misses fetch from the load balancer at no data transfer charge: AWS no longer charges data transfer out from an AWS origin to CloudFront.
- The Business flat-rate plan instead: one distribution with one apex domain and an AWS WAF web ACL, no unsupported feature, within the plan's allowances of 50 TB and 125 million requests a month (this traffic: 40 TB and 41.9 million requests). Usage beyond an allowance substantially and for long may see its delivery adjusted.
Not counted
- The load balancer's hours and capacity units, and the instances: fewer requests reach them through CloudFront, not priced here.
- The 100 GB a month of free data transfer out and the CloudFront free tier, not deducted; the Security Savings Bundle, Origin Shield and AWS WAF on pay-as-you-go.
Sources
- Amazon EC2 On-Demand Pricing
- Amazon CloudFront FAQs
- Amazon CloudFront pricing
- CloudFront flat-rate pricing plans
- How CloudFront delivers content
USD before tax, 730 h a month. AWS Price List, eu-west-3, Europe edge locations and global (CloudFront flat-rate plans), offer files published September 11, 2026, September 16, 2026 and October 3, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.
Want the same levers on your own bill?
Get a free auditHow to reduce NAT gateway and data transfer costs
Each lever below comes from AWS documentation; their order is this article's. AWS's own order for NAT gateways is on its pricing page for them: keep the heavy talkers in the NAT gateway's zone, or add a NAT gateway per zone, and move AWS service traffic to endpoints. Well-Architected's three practices for data transfer frame the rest: model it, choose components for it, and use the services that reduce it. The levers, in the order to work through them: see where the bytes go, remove what is idle, route each kind of traffic its cheapest way, reshape the network, commit where a commitment exists, and look again:
- Lever 01,SeeSee where the bytes goAlways, and first
- Lever 02,TrimDelete idle NAT gateways and release idle addressesGateways that process nothing
- Lever 03,RouteSend S3 and DynamoDB traffic through gateway endpointsPrivate subnets that reach S3 or DynamoDB
- Lever 04,RouteAdd interface endpoints where the volume pays for themAWS services with heavy traffic through NAT
- Lever 05,RouteKeep each zone's traffic in its zoneOne NAT gateway serving several zones
- Lever 06,RoutePut CloudFront in front of what the internet downloadsLarge public responses, viewers in Europe
- Lever 07,ReshapeCentralize egress when many VPCs send littleMany VPCs, little internet traffic each
- Lever 08,ReshapeKeep traffic in its RegionCross-Region lines on the bill
- Lever 09,ReshapeSend IPv6 traffic out through an egress-only internet gatewayNAT traffic reachable over IPv6
- Lever 10,ReshapeSend fewer bytesThe same objects sent again and again
- Lever 11,CommitCommit only where AWS offers a commitmentSteady CloudFront pay-as-you-go use
- Lever 12,ReviewReview on a cadenceEvery VPC and account
Lever 01 · See
See where the bytes go
Well-Architected's first step for data transfer (COST08-BP02): "Monitor data transfer: Use Amazon CloudWatch and VPC flow logs to capture details about your data transfer and network usage." And its rule for each line (COST08-BP01): "Link costs to outcomes: For each data transfer cost incurred, specify the outcome that it achieves for the workload." Each tool shows its own cut of the traffic:
What each tool shows of the traffic behind the bill
| Tool | What it shows |
|---|---|
| Cost Explorer usage type groups | NAT gateway hours and GB processed; data between zones, to the internet, to other Regions, to CloudFront |
| CUR | Each line by usage type, with where each GB came from and where it went |
| NAT gateway metrics in CloudWatch | The bytes each NAT gateway processed, by direction |
| VPC Flow Logs | The sources and destinations of the bytes, AWS services named |
Flow logs name the destinations a NAT gateway serves. On the gateway's network interface, "The dstaddr field displays the private IP address of the zonal NAT gateway network interface, and the pkt-dstaddr field displays the final destination IP address of the host on the internet", and pkt-dst-aws-service is "The name of the subset of IP address ranges for the pkt-dstaddr field, if the destination IP address is for an AWS service": S3 traffic through a NAT gateway shows as S3. The VPC FAQs put it as "the actual packet-level source and destination for traffic flowing through intermediate layers such as the NAT Gateway." Scope them, since they bill as vended logs (VPC Flow Logs and the NAT gateway's metrics): the NAT gateways' interfaces, for a time window, are enough to rank the destinations, AWS services among them.
Lever 02 · Trim
Delete idle NAT gateways and release idle addresses
Trusted Advisor's "Inactive NAT Gateways" check (cost optimization checks) has a plain rule: "A NAT Gateway is considered to be inactive if no data (0 bytes) was processed in the last 30 days." Its recommended action: "Consider deleting any NAT Gateways that weren’t used in the last 30 days and that aren’t required for external network access outside the VPC." Each idle zonal gateway costs this, before its address:
One NAT gateway that processes nothing
$36.50 a monthin Paris, 730 hours, computed, and its Elastic IP address on top, billed as in use while the gateway exists and as idle once the gateway is deleted, until it is released.
Computed from the AWS Price List · eu-west-3 · Oct 15, 2026
A second check, "Idle NAT gateways", "Checks your NAT gateway configurations and usage patterns to identify idle or underutilized NAT gateways that might be candidates for cost optimization", from Cost Optimization Hub, whose supported resources include "NAT Gateway". Both are Trusted Advisor checks, and "AWS Trusted Advisor checks are available to customers with an AWS Business Support+, AWS Enterprise Support, or AWS Unified Operations plan"; for the second, "To use this check, you must opt in to Cost Optimization Hub and AWS Compute Optimizer".
Before deleting one, update the route tables that name it. Addresses left behind are in Public IP insights: "Public IP insights shows you all public IPv4 addresses used by services across Regions. You can use these insights to identify public IPv4 address usage and view recommendations to release unused Elastic IP addresses." The EC2 article has the same lever for instances.
Lever 03 · Route
Send S3 and DynamoDB traffic through gateway endpoints
AWS's advice for NAT gateways (Pricing for NAT gateways): "If most traffic through your NAT gateway is to AWS services that support interface endpoints or gateway endpoints, consider creating an interface endpoint or gateway endpoint for these services." For S3 and DynamoDB the endpoint is free (COST08-BP03): "Gateway VPC endpoints have no hourly charges, and support Amazon S3 and Amazon DynamoDB." Add one to the route tables of the private subnets, and every GB to S3 in the Region leaves the NAT gateway's meter: pattern 1 removes its largest line that way. Image pulls count too, since "The gateway endpoint is required because Amazon ECR uses Amazon S3 to store your image layers". The cautions are on the S3 gateway endpoint page:
What to check before adding a gateway endpoint for S3, in AWS's words
| Caution | What the S3 gateway endpoint page says |
|---|---|
| Region | "A gateway endpoint is available only in the Region where you created it." |
| Reach | "Resources on the other side of a VPN connection, VPC peering connection, transit gateway, or Direct Connect connection in your VPC cannot use a gateway endpoint to communicate with Amazon S3." |
| Open connections | "An endpoint switches network routes, and disconnects open TCP connections." |
| Bucket policies | "You can't use the aws:SourceIp condition in an identity policy or a bucket policy for requests to Amazon S3 that traverse a VPC endpoint. Instead, use the aws:VpcSourceIp condition." |
| Quota | "Your account has a default quota of 20 gateway endpoints per Region, which is adjustable." |
So the endpoint serves its own VPC, in its own Region. DynamoDB's gateway endpoints follow the same rules, and "Gateway endpoints support only IPv4 traffic". The S3 article has the lever from S3's side, and the EKS article for image pulls.
Lever 04 · Route
Add interface endpoints where the volume pays for them
"Interface VPC endpoints are provided by AWS PrivateLink and have an hourly fee and per-GB usage cost", so an interface endpoint replaces the NAT gateway's processing with a smaller per-GB rate and adds hours of its own. In Paris it pays for itself above 602.25 GB a month in three zones, and 401.50 GB in two, computed (VPC endpoints in Paris). CloudWatch Logs, ecr.api and ecr.dkr, Amazon SQS, AWS KMS and AWS STS, for example, each have their own endpoint (AWS services that integrate with AWS PrivateLink). Pattern 1 sends 3 TB a month of logs through one. A private subnet with no NAT gateway at all needs one for each service it calls, whatever the volume. By volume, for one service:
One AWS service's traffic through the NAT gateways or an interface endpoint in three zones, a month (computed)
| Traffic a month | Through NAT | Through an endpoint | Cheaper |
|---|---|---|---|
| 100 GB | $5.00 | $25.09 | NAT |
| 500 GB | $25.00 | $29.09 | NAT |
| 1,024 GB | $51.20 | $34.33 | Endpoint |
| 3,072 GB | $153.60 | $54.81 | Endpoint |
Computed from the AWS Price List, eu-west-3, offer files published September 17, 2026 and October 15, 2026, fetched October 16, 2026.
The NAT gateways' own hours are on neither side: they stay for the internet traffic. Production endpoints need two zones at least (Access AWS services through AWS PrivateLink): "Configure at least two Availability Zones per VPC endpoint and deploy your AWS resources that must access the AWS service in these Availability Zones." And the billing basis is the zone, not the traffic: "You are billed for each hour that your interface VPC endpoint is provisioned in each Availability Zone. You are also billed per GB of data processed." Many low-volume endpoints can cost more than the processing they remove, and a resource in a zone without the endpoint's interface reaches it across zones, at the cross-zone rate.
Lever 05 · Route
Keep each zone's traffic in its zone
AWS's advice on the NAT gateway pricing page: "If your AWS resources send or receive a significant volume of traffic across Availability Zones, ensure that the resources are in the same Availability Zone as the NAT gateway. Alternatively, create a NAT gateway in each Availability Zone with resources." Well-Architected's version (COST08-BP02): "Check whether the resources behind the NAT gateway that send the most traffic are in the same Availability Zone as the NAT gateway. If they are not, create new NAT gateways in the same Availability Zone as the resource to reduce cross-AZ data transfer charges." Each GB that crosses on its way pays $0.02, computed, on top of the processing:
1 TB a month from another zone to a NAT gateway
$20.48 a monthof cross-zone data transfer in Paris, each GB billed out of one zone and into the other, computed, on top of the NAT processing, which is the same in either zone.
Computed from the AWS Price List · eu-west-3 · Sep 16, 2026
So a NAT gateway per zone, or one regional NAT gateway, costs less above 6,022.50 GB a month through NAT in three zones, and one shared gateway costs less below it, computed (pattern 2). The rest of the traffic follows the same rule: chatty components in one zone where the design allows it, and neighbours reached by their private addresses, not their public ones. The EC2 article, the RDS article and the EKS article apply it to instances, databases and Pods.
Lever 06 · Route
Put CloudFront in front of what the internet downloads
Well-Architected names content delivery networks among the ways to architect for data transfer (COST08-BP02): "Architecting for data transfer minimizes data transfer costs. This may involve using content delivery networks to locate data closer to users". CloudFront "caches data at edge locations across the world, which reduces the load on your resources". On the bill, three things change: the origin's transfer to CloudFront is free, CloudFront's own GB costs less than Paris's on every aligned tier, and its requests are billed. Pattern 4 puts numbers on the trade: with 1 MB responses, the per-GB saving outweighs the requests, and below about 252 KB on average it would not, computed. With smaller responses, the requests win:
Served straight from Paris Illustrative
| Line | A month |
|---|---|
| Network | |
| Data out to the internet, first 10 TB tier10,240 GB × $0.09 /GB | $921.60 |
| A month, computed | $921.60 |
Served through CloudFront Illustrative
| Line | A month |
|---|---|
| Network | $971.06 |
| Origin to CloudFront10,240 GB × $0.00 /GB | $0.00 |
| CloudFront out, first 10 TB tier10,240 GB × $0.085 /GB | $870.40 |
| HTTPS requests83,886,080 requests × $0.012 /10K req | $100.66 |
| A month, computed | $971.06 |
Through CloudFront costs $49.46 a month more than straight from Paris (5.4% more), computed.
USD before tax, 730 h a month. AWS Price List, eu-west-3 and Europe edge locations, offer files published September 16, 2026 and October 3, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.
The cache helps the bill only through what reaches the origin; every byte to a viewer is still billed. For the hit ratio, AWS advises to "specify the longest practical value for max-age" (cache hit ratio); for the bytes, "Serving compressed objects can be less expensive than serving them uncompressed". A flat-rate plan replaces the per-GB and per-request lines with one monthly price, on its conditions (flat-rate plans), and "You incur additional charges for using Origin Shield". The S3 article does the same sums for objects served from S3.
Lever 07 · Reshape
Centralize egress when many VPCs send little
The whitepaper's case for it (Using the NAT gateway for centralized IPv4 egress): "Deploying a NAT gateway in every spoke VPC can become cost prohibitive because you pay an hourly charge for every NAT gateway you deploy", and "Centralizing NAT gateways can be a viable option to reduce costs." Its cost, in the same page: "When you centralize NAT gateway using Transit Gateway, you pay an extra Transit Gateway data processing charge — compared to the decentralized approach of running a NAT gateway in every VPC." The egress VPC keeps a NAT gateway per zone: "For high availability, you should use more than one NAT gateway (one in each Availability Zone)." Trusted Advisor's inactive NAT gateway check suggests the same design: "If a Transit Gateway is used for inter-VPC communication, then consider deploying a centralized NAT Gateway for egress to internet architecture." Each attachment costs this:
One transit gateway attachment
$43.80 a monthin Paris, 730 hours, computed: the egress VPC's own, and a spoke's if it has none yet, on top of the processing of every GB.
Computed from the AWS Price List · eu-west-3 · Sep 17, 2026
Pattern 3 prices twelve spokes, and the break-even per spoke. Interface endpoints can be centralized the same way (Centralized access to VPC private endpoints), with private hosted zones to manage, and "Single policy document also results in larger blast radius." A shared VPC is the other way to let several accounts use one set of NAT gateways and endpoints (Between VPCs).
Lever 08 · Reshape
Keep traffic in its Region
"Avoid transferring data across Regional boundaries: Data transfers between AWS Regions (from one Region to another) typically incur charges. It should be a very thoughtful decision to pursue a multi-Region path". Read and write data in the workload's Region, and replicate to another only what the recovery plan needs. The destination matters: from Paris, most Regions cost $0.02 per GB, and a few more (Across zones and Regions):
10 TB a month from Paris to Frankfurt
$204.80 a monthof inter-Region data transfer, billed on the Paris side only, computed: the data arriving in Frankfurt is not billed.
Computed from the AWS Price List · eu-west-3 · Sep 16, 2026
Two endpoint rules apply across Regions: a gateway endpoint works in its own Region only, and an interface endpoint to a service in another Region adds inter-Region transfer to its own hours and processing, which its owner pays in both directions (VPC endpoints in Paris). The S3 article prices replication between Regions.
Lever 09 · Reshape
Send IPv6 traffic out through an egress-only internet gateway
Give the subnets IPv6 and route ::/0 to an egress-only internet gateway, and the traffic to IPv6 destinations leaves without NAT processing: "There is no charge for an egress-only internet gateway", and "Egress-only internet gateways have no charge". Each GB that moves saves the NAT gateway's $0.05 of processing, and still pays data transfer out:
- Charge
- $0.05 an hour and $0.05 per GB processed, then data transfer out
- Traffic
- IPv4 out, and IPv6 to IPv4 destinations through NAT64
- Filtering
- No security group on the gateway
- Charge
- None, then data transfer out
- Traffic
- IPv6 out only
- Filtering
- No security group on the gateway: the network ACLs and the instances' security groups filter
What differs: the NAT processing, on the share of the traffic that goes to IPv6 destinations only.
AWS gives no figure for the share of traffic that IPv6 reaches, so this article prices no pattern for it. The gateway filters nothing itself, "You can't associate a security group with an egress-only internet gateway", so the subnet's network ACL and the instances' security groups do the work.
Lever 10 · Reshape
Send fewer bytes
Every GB not sent is a GB neither processed nor transferred. Well-Architected's general advice (COST08-BP02): "You can also use WAN optimization and application optimization to reduce the amount of data that is transferred between components." AWS documents the saving where CloudFront does the work, compressing and caching what it serves (Put CloudFront in front of what the internet downloads); for the rest, what an application sends is its own design, and this article gives no figure for it.
Lever 11 · Commit
Commit only where AWS offers a commitment
No Savings Plan or reservation covers NAT gateways, VPC endpoints, Transit Gateway or data transfer: their price list offers have On-Demand terms only. CloudFront has one commitment, the Security Savings Bundle, which "helps you save up to 30% on your CloudFront bill in exchange for making a commitment to a consistent amount of monthly usage", "for a 1 year term":
AWS says
Up to 30%off a CloudFront pay-as-you-go bill with the Security Savings Bundle, for a one-year commitment to a consistent monthly amount; it has no price in the AWS Price List.
AWS · Amazon CloudFront FAQs
Well-Architected repeats it: "The security savings bundle can help you to save up to 30% on your CloudFront usage if you plan to grow your usage over time". It does not stack with a plan: "CloudFront Security Savings Bundle savings do not apply to CloudFront flat-rate pricing plans."
Lever 12 · Review
Review on a cadence
"The review effort should reflect potential benefit. For example, core workloads or workloads with a value of over ten percent of the bill are reviewed quarterly or every six months, while workloads below ten percent are reviewed annually". The network gives its own reasons to look again: new VPCs and accounts bring their own NAT gateways; the break-evens of this article move with the traffic; a regional NAT gateway expands and contracts with the workloads; and services gain interface endpoints. Well-Architected's modelling advice holds at each review (COST08-BP01): "Model the costs over different usage levels."
In short: Route before you reshape: see which traffic each line bills, remove the idle gateways, send S3 and DynamoDB through free gateway endpoints and the heavy AWS services through interface endpoints, keep each zone's traffic in its zone, and only then centralize, move Regions or commit.
FAQ
How much does a NAT gateway cost per month?
In Paris, a NAT gateway costs $0.05 per hour, $36.50 a month at 730 hours, computed, per zonal gateway or per zone of a regional one, and $0.05 per GB it processes, in either direction. A public one adds its Elastic IP address, $40.15 a month in all before any traffic, and the data transfer behind it bills on top (NAT gateways in Paris).
Is traffic to S3 through a NAT gateway charged?
The transfer is free in the same Region; the NAT gateway's processing is not: $0.05 per GB in Paris, $0.07 through a gateway in another zone, computed. A gateway endpoint for S3 removes it, at no charge (Send S3 and DynamoDB traffic through gateway endpoints).
Is data transfer between Availability Zones charged?
Yes, in each direction: $0.01 per GB out of one zone and the same into the other in Paris, so $0.02 per GB that crosses, computed, shown as two lines on the bill. Within one zone, by private address, it is free; AWS lists exceptions such as an Application Load Balancer and its targets, and RDS Multi-AZ replication (Across zones and Regions).
Do I need a NAT gateway in every Availability Zone?
For resilience, AWS recommends one per zone, each zone routed to its own. For cost, it depends on the traffic: in three zones, one gateway per zone costs less than one shared gateway above 6,022.50 GB a month through NAT, computed. A regional NAT gateway gives one per zone automatically, billed per zone at the same price (pattern 2).
Does CloudFront reduce data transfer costs?
Often: data from an AWS origin to CloudFront is free, and CloudFront's GB costs less than Paris's internet egress on every aligned tier, but its requests are billed. With large responses it costs less, with small ones it can cost more: below about 252 KB per response at 40 TB a month in pattern 4, computed. A flat-rate plan replaces both lines with one monthly price, on its conditions (CloudFront in front).