AWS NAT gateway pricing: what a NAT gateway costs and how to reduce it

A network address translation (NAT) gateway gives instances in a private subnet a way out to the internet and to AWS services. A private subnet is one whose route table has no route to an internet gateway.

AWS charges for a NAT gateway in three ways:

• Each NAT gateway-hour the gateway is provisioned and available. A partial hour counts as a full hour.
• Each GB the gateway processes, whatever the traffic’s source or destination.
• Standard AWS data transfer charges on the data it carries, such as the egress cost of data going out to the internet.

A public NAT gateway uses an Elastic IP address. AWS charges $0.005 an hour for every public IPv4 address, in use or idle: $3.65 over a 730-hour month.

A standard NAT gateway is zonal: it works in one Availability Zone. For high availability, you create one in each zone and route each zone’s private subnets to it.

Three zones then pay three hourly charges: 3 × 730 × $0.045 = $98.55 a month at the Ohio rate, before any data is processed.

A regional NAT gateway is one gateway that spans zones. In its automatic mode, which AWS recommends, it expands to each zone where your workloads have network interfaces. AWS charges it by the hour in each zone, so three zones cost $0.135 an hour, as three zonal gateways do.

AWS recommends private subnets for the nodes of an Amazon Elastic Kubernetes Service (EKS) cluster. With no route to an internet gateway, the nodes and their pods reach the internet through a NAT device. They reach AWS services through it too, or through virtual private cloud (VPC) endpoints.

Without VPC endpoints, the NAT gateway carries what your nodes and pods send to AWS services, as well as to the internet. Each GB pays the processing charge. AWS gives these services as examples:

• Amazon Elastic Container Registry (Amazon ECR)
• Elastic Load Balancing
• Amazon CloudWatch
• AWS Security Token Service (AWS STS)
• Amazon Simple Storage Service (Amazon S3)

AWS’s own pricing example sends 1 GB from an instance to Amazon S3 in the same Region. The NAT gateway charges $0.045 to process it, while the data transfer itself has no charge.

Send Amazon S3 and DynamoDB traffic through gateway endpoints

A gateway endpoint reaches Amazon S3 or Amazon DynamoDB without a NAT device, with no hourly or data processing charge. When you create one, AWS adds a route to each route table you pick.

It covers only its own Region, because its route uses that Region’s prefix list for the service. Traffic to S3 in another Region doesn’t use it.

Weigh interface endpoints for other AWS services

If most NAT traffic goes to services such as Amazon ECR or CloudWatch, AWS suggests interface endpoints. They’re priced under AWS PrivateLink, so compare that price with the processing charge first.

Keep heavy traffic in the NAT gateway’s zone

Data between an instance and a NAT gateway in another zone pays data transfer charges. For heavy traffic across zones, AWS suggests moving the resources into the NAT gateway’s zone. The other choice is a NAT gateway in each zone with resources, which adds an hourly charge per zone.

Delete NAT gateways nothing routes to

Before you delete a gateway, check which route tables send traffic to it. Their subnets lose that way out, and the routes stay in a blackhole status until you update or delete them.

Deleting a gateway doesn’t release its Elastic IP address from your account. Release it too if nothing else needs it, or it keeps its $0.005 hourly charge as an idle public IPv4 address.

Azure NAT Gateway gives the resources in a subnet outbound internet access, and it doesn’t permit unsolicited inbound connections. Since 31 March 2026, new virtual networks default to private subnets without default outbound access. They need an explicit way out, such as a NAT gateway.

Azure charges for it in two ways, as AWS does:

• Resource hours, from the moment the gateway is created, with or without subnets or public IP addresses attached. A partial hour counts as a full hour.
• Each GB processed, outbound and return traffic alike.

Standard NAT gateways are zonal and StandardV2 ones are zone redundant, at the same price. Bandwidth charges for data leaving Azure apply on top, and Azure lists its rates by region.