PacketSensei

NAT gateway cost calculator

A NAT gateway bills two ways: a flat hourly charge per gateway, and a per-gigabyte charge on everything that passes through it. The second one is what surprises people, because traffic to S3, DynamoDB, ECR, and the other AWS services in your own region is usually a large share of it — and a VPC endpoint can take that traffic out of the NAT path entirely.

One per availability zone is the usual highly-available shape.
All traffic through the gateway, in both directions.
S3, ECR image pulls, DynamoDB, CloudWatch Logs, SSM, Secrets Manager.
S3 and DynamoDB gateway endpoints are free; everything else is an interface endpoint.
Rates (defaults are us-east-1 list prices — check current pricing for your region)

Result

What this does and does not include

Included: NAT gateway hourly charges, NAT per-GB data processing, interface endpoint hourly charges per availability zone, and interface endpoint per-GB charges. Gateway endpoints for S3 and DynamoDB have no hourly or per-GB charge at all, which is why they are close to free money for any workload that touches either service.

Not included: data transfer out to the internet, which you pay regardless of the path; cross-AZ transfer charges, which you can incur by sending traffic to a NAT gateway or endpoint in another zone; and Elastic IP charges. Rates change and vary by region — treat the defaults as a starting point and replace them with the ones on the AWS pricing page for your region.

The most common single win here is the S3 gateway endpoint. It costs nothing, takes one route table entry, and removes every byte of S3 traffic from the NAT gateway's per-GB meter. If your workload pulls container images, writes logs, or reads data from S3 and you do not have one, that is the first thing to fix.