NAT gateway vs VPC endpoint: what it costs and when to switch
Short answer: send S3 and DynamoDB traffic through free gateway endpoints, and put an interface endpoint in front of any other AWS service that moves more than a few hundred GB a month. Everything else on the NAT gateway is the price of reaching the internet from a private subnet.
What a NAT gateway costs (us-east-1 list prices, illustrative)
Hourly: $0.045 per gateway-hour, about $32.85 a month, whether or not anything uses it.
Public IPv4: $0.005 per hour for the address, about $3.65 a month.
Processing: $0.045 per GB in either direction, for every destination, including AWS services in the same region.
What the alternatives cost
Gateway endpoint (S3, DynamoDB): free. It is a route-table entry, with no hourly fee and no per-GB fee.
Interface endpoint (most other services): $0.01 per hour per AZ (about $7.30 a month per AZ) plus $0.01 per GB. Break-even against the NAT gateway is about 209 GB a month per endpoint per AZ.
Services that need several endpoints: ECR needs ecr.api and ecr.dkr (plus the free S3 gateway endpoint for image layers); SSM needs ssm, ssmmessages and ec2messages; ECS needs ecs, ecs-agent and ecs-telemetry. The fixed fee multiplies, and so does the break-even.
IPv6: outbound IPv6 through an egress-only internet gateway has no per-GB processing fee.
Find the avoidable spend
Get GB per destination: VPC Flow Logs on the NAT gateway's network interface summed by destination, or Cost Explorer usage type NatGateway-Bytes by gateway.
Write one row per gateway and destination: nat-0a1,s3,4200.
Paste into the advisor, or run node cli.mjs analyze nat.csv. It prints a create-vpc-endpoint command for each endpoint that saves money.
Create the endpoint in one VPC first. A gateway endpoint adds routes to the route tables you name; an interface endpoint with private DNS changes where the service name resolves, and its security group must allow 443 from the VPC.
Questions
How much does a NAT gateway cost?
In us-east-1 a NAT gateway costs $0.045 per hour (about $32.85 a month) plus $0.045 for every GB it processes, in either direction, plus $0.005 per hour (about $3.65 a month) for its public IPv4 address. Three gateways, one per AZ, cost about $110 a month before any traffic.
Is S3 traffic through a NAT gateway charged?
Yes. The NAT gateway charges $0.045 per GB for every byte it processes, including bytes to S3 in the same region. A gateway endpoint for S3 is free, so moving that traffic to it removes the charge. The same is true for DynamoDB.
Do VPC endpoints cost money?
Gateway endpoints (S3 and DynamoDB) are free. Interface endpoints cost $0.01 per hour per AZ plus $0.01 per GB processed, so they only beat the NAT gateway's $0.045 per GB above a break-even volume of about 209 GB a month per endpoint per AZ.