AWSNetworking5 min read

Explain AWS NAT Gateway cost increases

Sources checked September 9, 2026Varies by scope

On this page

THE SHORT ANSWER

Run the read-only billing command to group account usage by USAGE_TYPE and AZ, then separate NAT Gateway hours, processed usage, and transfer-related lines before changing network paths.

Why this is worth a look

AWS documents three distinct NAT Gateway billing components: provisioned gateway-hours, data processing per gigabyte, and standard AWS data transfer through the gateway. A higher charge can therefore reflect more provisioned time, more processed data, or transfer on the traffic path. GetCostAndUsage can return cost and usage metrics and group them by USAGE_TYPE and AZ. Use that output for cost categories, then use VPC Flow Logs to inspect traffic direction and NAT gateway CloudWatch metrics as separate diagnostic inputs. This does not attribute a billing line to a workload by itself.

Start with this query

BASH

Run AWS Cost Explorer for the account and time window, grouping cost and usage by the documented USAGE_TYPE and AZ dimensions. Review the returned usage types for NAT and transfer-related lines.

set -euo pipefail

aws ce get-cost-and-usage \
  --time-period Start=2026-08-01,End=2026-09-01 \
  --granularity DAILY \
  --metrics UnblendedCost UsageQuantity \
  --group-by Type=DIMENSION,Key=USAGE_TYPE Type=DIMENSION,Key=AZ

How to confirm it

01
Set the billing window
Edit Start and End for the period you are investigating. The command uses DAILY granularity, returns UnblendedCost and UsageQuantity, and covers the account or billing view visible to your credentials. Its end date is exclusive.
02
Run the read-only command
Run the command with permission to call ce:GetCostAndUsage. It uses the documented USAGE_TYPE and AZ groupings and has no usage-type filter, so the account-level result is broader than NAT Gateway charges. Identify the returned NAT and transfer-related usage types before comparing them.
03
Keep units separate
Compare cost by usage type, not a combined UsageQuantity total. AWS warns that usage quantities can use different units, such as hours and gigabytes. Keep gateway-hour, processed-data, and transfer-related lines separate when interpreting the result.
04
Inspect network observations
Use VPC Flow Logs to inspect traffic reaching and leaving network interfaces and its direction. Separately review the available metrics in the AWS/NATGateway CloudWatch namespace. These observations can help investigate traffic, but the billing grouping itself does not identify the responsible workload.

Before making changes

Assumptions: Cost Explorer is available, your credentials have ce:GetCostAndUsage, and the account or billing view includes the target usage. The command has account-level scope, groups by USAGE_TYPE and AZ, and reports AWS cost and usage for the selected daily window. UsageQuantity units differ by usage type. VPC Flow Logs have their own data ingestion and archival charges, and NAT gateway metrics are sent to CloudWatch at 1-minute intervals. Current-period CUR data is estimated until AWS finalizes it.

Ignore this when finalized monthly billing reconciliation is required and finalized CUR data is available, or when the account-level window contains no NAT Gateway usage to investigate.