NAT Gateway

What is a NAT gateway?

A NAT gateway lets instances in private subnets initiate outbound internet connections — pulling packages, calling APIs, downloading container images — while accepting no unsolicited inbound traffic. It performs source-address translation: private IPs leave stamped with the gateway’s Elastic IP, replies flow back through the established connection state. It’s the standard answer to “private tier needs the internet, the internet must not reach the private tier.”

The bill nobody budgets

NAT pricing is ~$0.045/hour *plus ~$0.045 per GB processed*, and the per-GB half is the famous trap: every S3 download, ECR image pull, and third-party API call from private subnets pays it. Teams discover four-figure monthly NAT charges from container pulls alone. The fixes are well-trodden — VPC gateway endpoints for S3/DynamoDB (free, bypass NAT entirely), interface endpoints for high-volume AWS services, ECR pull-through caches — and routinely cut NAT data processing 80–95%. Auditing NAT flow logs for top talkers is among the highest-ROI hours in cloud cost work.

Placement and resilience

A NAT gateway lives in one AZ. The resilient pattern is one per AZ, with each private subnet routing to its local gateway — otherwise an AZ outage takes down outbound connectivity for every zone, and cross-AZ NAT traffic adds transfer charges on top. It scales automatically to tens of Gbps, but has connection-count limits per destination that bulk scrapers and mass-parallel workloads can hit.

What people get wrong

• NAT in a private subnet — it must sit in a public subnet with an internet gateway route, or nothing flows.
• One NAT for the whole VPC as a cost saving that becomes an availability and transfer-cost mistake.
• Using NAT for AWS-service traffic that endpoints would carry free.

Primary source: AWS VPC documentation — NAT gateways

The Cost Consideration That Shapes Architecture

Because NAT Gateway charges apply per gigabyte of data processed in addition to an hourly charge, applications that route large volumes of outbound traffic through a NAT Gateway — downloading large datasets, calling external APIs with big payloads, or synchronizing data with third-party services — can see this cost become unexpectedly significant at scale. This has led many architectures to specifically route traffic to AWS’s own services (S3, DynamoDB) through VPC Gateway Endpoints instead, which bypass the NAT Gateway (and its per-gigabyte charge) entirely for traffic that never actually needs to leave AWS’s network, a cost optimization that’s easy to overlook until a bill review surfaces NAT Gateway data processing as an outsized, avoidable line item.