AWS NAT Gateway: fewer gateways, same NatGateway-Bytes

Consolidating NAT gateways leaves NatGateway-Bytes unchanged while the same traffic still passes through NAT, because AWS charges data processing on each gigabyte processed regardless of the traffic's source or destination. In us-east-1 that is $0.045 per GB, plus $0.045 per gateway-hour for availability, both checked 26 September 2026. It is the trap for a platform team that sees EC2 - Other climbing while its gateway count stays flat, where consolidation looks like the obvious fix. On NAT's own meters, fewer gateways change only the hourly charge, and consolidation can add cross-AZ transfer on a separate line.

Worked example (illustrative): 3 zonal gateways each run for 730 hours and process 50,000 GB combined, of which 30,000 GB is same-Region S3 traffic. Processing costs 50,000 × $0.045 = $2,250. Running hours cost 3 × 730 × $0.045 = $98.55. Removing two of the three gateways saves at most 2 × 730 × $0.045 = $65.70 of that $2,348.55 subtotal, under 3%, before any added transfer.

Processing passes running hours above 730 GB per gateway

One gateway costs 730 × $0.045 = $32.85 for a 730-hour month before processing a single byte. Processing reaches that amount at 730 GB. The threshold scales with billed hours, and AWS bills each partial gateway-hour as a full hour.

Every processed gigabyte counts, including responses and downloads pulled from S3 through NAT inside the same Region. Counting only outbound application requests misses the return traffic on the network address translation (NAT) path.

Standard data transfer charges sit on top and are billed separately. Sending a file through NAT to a non-AWS internet location incurs a transfer charge alongside processing, and an EC2 instance whose NAT gateway sits in a different Availability Zone (AZ) adds a transfer charge between them. Rates also vary by Region: eu-west-1 is $0.048 for both meters on the same check date, so rerun the arithmetic below against the Regions carrying your traffic.

In the example, a gateway endpoint for S3 saves $1,350 a month

If that 30,000 GB of same-Region S3 traffic moves to a gateway endpoint after route and access checks, it stops incurring NAT processing. The other 20,000 GB stays on NAT, and gateway endpoints carry no hourly charge and no data processing charge at all.

That is $2,348.55 − $998.55 = $1,350 a month, or $16,200 if the volume repeats for 12 months. The saving covers NAT processing only. Any change in transfer charges is a separate line to compare.

Gateway endpoints are the first move for eligible same-Region S3 and DynamoDB traffic that currently goes through NAT. The route uses an AWS-owned service prefix list as the destination and the endpoint as the target. Reach is same-Region: an S3 endpoint cannot serve buckets in another Region, and DynamoDB gateway endpoints do not allow access from on-premises networks. Confirm the bucket or table Region and the existing route table, check access requirements, then test the application before shifting traffic.

Three-AZ interface endpoints need about 626 GB to beat NAT

Interface endpoints bill differently. In us-east-1, rates checked 26 September 2026 were $0.01 per endpoint-hour per AZ and $0.01 per GB in the first tier, which covers the first 1 PB across all interface endpoints in the Region.

Worked comparison (illustrative): add one interface endpoint across 3 AZs for 730 hours while NAT stays in place for other destinations, holding transfer charges constant. The added availability cost is 3 × 730 × $0.01 = $21.90. Each shifted gigabyte saves $0.045 − $0.01 = $0.035.

Break-even is $21.90 ÷ $0.035 = 625.7 GB a month across those placements. At 500 GB, NAT processing costs $22.50 against $26.90 for the endpoint. At 1,000 GB it is $45 against $31.90, a $13.10 saving. So use an interface endpoint when the shifted volume clears roughly 626 GB at these rates. Recalculate if you add endpoints, or if the change also lets a NAT gateway go.

Consolidation loses its hourly saving at 6,570 cross-AZ GB

Removing 2 of the example's 3 zonal gateways saves 2 × $32.85 = $65.70 a month. The EC2 On-Demand pricing page, checked 26 September 2026, charges traffic between Elastic Network Interfaces across AZs in the same Region $0.01 per GB in each direction.

At that rate, an extra $65.70 ÷ $0.01 = 6,570 GB (about 6.57 TB) of cross-AZ traffic erases the hourly saving. Count actual gigabytes in each direction. If two-thirds of the remaining 20,000 GB crosses AZs after consolidation, (2/3) × 20,000 × $0.01 = $133.33. Do not multiply by 2 again, because those 20,000 GB already include both directions, and $133.33 already exceeds the $65.70 saved.

Where the cross-AZ charge beats the avoided hours, keep a NAT gateway in each AZ that has resources and route clients to their local one. AWS recommends that layout for resiliency as well. Below break-even, consolidation does save money on this comparison alone, and the resilience tradeoff is a separate decision.

Regional NAT does not remove per-AZ running charges. Introduced 19 November 2025, a single regional gateway expands and contracts across AZs, and it is charged for each hour it is configured in each AZ. Three configured AZs for 730 hours at the us-east-1 rate still cost $98.55, the same as the three zonal gateways.

CUR separates billed hours from processed gigabytes

Cost Explorer, AWS's cost analysis tool, groups NAT charges under EC2 - Other, with filters named "EC2: NAT Gateway - Data Processed" and "EC2: NAT Gateway - Running Hours". Anyone without console access can ask the billing team for both totals across complete months. That split alone shows whether processing or availability dominates.

Resource-level detail comes from the Cost and Usage Report (CUR) 2.0 in Athena, AWS's SQL query service. This read-only query splits gateway hours from processed gigabytes. Point cur2_db.cur2_table at the real database and table; line_item_resource_id is populated only when the export is configured with INCLUDE_RESOURCES.

SELECT
  date_trunc('month', line_item_usage_start_date) AS usage_month,
  line_item_usage_account_id AS account_id,
  line_item_resource_id AS resource_id,
  product_region_code AS region,
  CASE
    WHEN line_item_usage_type LIKE '%NatGateway-Hours' THEN 'hours'
    WHEN line_item_usage_type LIKE '%NatGateway-Bytes' THEN 'data_processed_gb'
    ELSE 'other'
  END AS charge_type,
  SUM(line_item_usage_amount) AS usage_amount,
  SUM(line_item_unblended_cost) AS unblended_cost_usd
FROM cur2_db.cur2_table
WHERE line_item_usage_type LIKE '%NatGateway-%'
  AND line_item_line_item_type = 'Usage'
  AND line_item_usage_start_date >= CAST(date_add('month', -3, date_trunc('month', current_date)) AS timestamp)
GROUP BY 1, 2, 3, 4, 5
ORDER BY usage_month DESC, unblended_cost_usd DESC;

Each row is one month, account, resource ID, Region and charge type, covering 3 prior complete months plus the current partial month. Compare complete months only, and note that without resource IDs there is no per-gateway attribution.

hours and data_processed_gb are different units, so never sum them. Both the unprefixed us-east-1 NatGateway-Bytes and the regional-mode USE1-RegionalNatGateway-Bytes land in data_processed_gb; other collects any remaining NAT gateway usage types, so inspect those before adding them up. Cost is unblended usage cost and excludes transfer, so dividing summed cost by summed usage gives a usage-weighted average rate only within one usage type. Neither label names a workload or a destination, so billing totals cannot establish which bytes qualify for an endpoint.

Flow logs connect traffic spikes to source-destination pairs

CloudWatch metrics locate the spikes. BytesInFromSource counts bytes the gateway received from clients in the VPC, and BytesOutToDestination counts bytes it sent onward. These are successive stages of the same flow, so adding them together overstates demand, while BytesInFromDestination and BytesOutToSource cover the return path.

For the window a spike lands in, ask the network owner for one thing: summed bytes grouped by pkt-srcaddr, pkt-dstaddr and flow-direction, pulled from VPC flow logs with CloudWatch Logs Insights or Athena. Those are the original packet-level addresses, which survive translation, and flow-direction keeps ingress and egress apart. Use the largest pairs to identify the responsible workloads, then have the network owner verify their routes.

The AWS command-line interface (CLI) supplies the inventory to match against. This read-only command lists the gateways that exist in us-east-1 and says nothing about how much they process.

aws ec2 describe-nat-gateways --region us-east-1 \
  --filter Name=state,Values=available \
  --query 'NatGateways[].{Id:NatGatewayId,Vpc:VpcId,Subnet:SubnetId,Mode:AvailabilityMode,Type:ConnectivityType}' \
  --output json

Mode returns zonal or regional, and Subnet can be empty for a regional gateway. The output does not reveal which client routes cross AZs, which is the number the consolidation arithmetic above turns on.

An idle-gateway flag still needs a route and owner check

Compute Optimizer flags NAT gateways with no traffic activity over a 32-day analysis period. Trusted Advisor has checked route-table association since 23 February 2026, which reduces false positives. Neither result says whether a gateway will be needed again.

An available idle zonal gateway costs $32.85 for a 730-hour month in us-east-1. Before deleting one, have the workload owner verify route dependencies and future need, then get change approval.