NAT gateways and PrivateLink: the cloud networking lines that decide a monthly bill

The line that grows with traffic, not with seats

AWS publishes two charges for a NAT gateway and only one of them is fixed. The hourly charge is $0.045 per NAT gateway-hour in US East (Ohio), applied for as long as the gateway is provisioned and available, and each partial NAT gateway-hour consumed is billed as a full hour. The second charge is data processing at $0.045 per GB, applied for each gigabyte processed through the gateway regardless of the traffic's source or destination.

That second line is the one a budget review finds. A gateway that sits idle costs its hourly rate and nothing more; a gateway carrying a busy workload costs its hourly rate plus a per-gigabyte toll on every byte that passes through it, in either direction. Standard AWS data transfer charges apply on top for all data transferred via the NAT gateway.

AWS works the arithmetic in its own example. An EC2 instance behind a NAT gateway sends a 1 GB file to an S3 bucket in the same region and the same Availability Zone, and the data processing charge comes to $0.045, with the $0.045 hourly charge applying on top. The data transfer itself is free in that example because the traffic stays inside the region and inside the Availability Zone on private IP addresses. Send the same file to a non-AWS internet location and a data transfer out charge appears as well.

The cost model is therefore not a capacity decision. Two teams can run identical instance counts and identical storage, and one pays several times what the other pays for the same egress volume, because one routes internal traffic through a NAT gateway and the other does not.

Regional NAT multiplies the hourly line by the AZ count

AWS now offers a regional NAT gateway, and its billing differs from the zonal product in a way that matters before a design is signed off. A regional NAT gateway is charged for each hour it is configured in each Availability Zone. AWS's example is explicit: a regional NAT running across three Availability Zones for one hour is billed as three NAT gateway-hours.

The data processing charge is unchanged. It applies for each gigabyte processed through the regional NAT gateway regardless of the traffic's source or destination, and standard data transfer charges still apply. Partial hours are still rounded up to a full hour.

There is one piece of relief in the model. When a regional NAT gateway removes support from an Availability Zone following a change in workload footprint, billing adjusts automatically and the charge for that AZ stops. A zonal gateway has no equivalent, because the way to stop being charged for a NAT gateway is to delete it through the console, the command line interface or the API.

The practical consequence is that a three-AZ regional deployment carries three times the hourly line of a single zonal gateway before a single gigabyte moves. That is the price of the availability the regional product is bought for, and it belongs in the comparison rather than in a footnote.

What it costs before and after

The table below holds only figures AWS publishes on its VPC pricing page, plus the one charge AWS states is zero. It is not a total cost of ownership; it is the set of lines that move when a team changes how internal traffic reaches S3 and how many Availability Zones the gateway spans.

The gateway endpoint row is the one to take to an architecture review. AWS states plainly that there are no data processing or hourly charges for using gateway-type VPC endpoints, and that routing S3 traffic through one instead of the NAT gateway avoids the data processing charge in its own worked example. The saving is not a discount negotiated at renewal; it is a line that stops existing.

For PrivateLink interface endpoints, the page above does not publish a per-hour or per-gigabyte rate. That number is unpublished in the material available here, and the thing to ask an account team for is the interface endpoint hourly charge and the data processing charge per GB in the region the workload runs in, quoted against the same 10 TB monthly volume used for the NAT gateway comparison.

PrivateLink changes the topology, and the bill follows the topology

AWS PrivateLink lets clients in a VPC connect to services and resources in other VPCs using private IP addresses, as if those services were in the same network. Consumers create VPC endpoints to reach endpoint services and resources offered by AWS, AWS Partners and other AWS accounts. The traffic no longer needs a route to the internet, which is the security argument, and it also no longer needs a NAT gateway, which is the cost argument.

The provider side has its own shape. A service provider must specify a load balancer when creating an endpoint service, and by default that endpoint service is not available to consumers until permissions are added that allow specific AWS principals to connect. Each endpoint service is identified by a service name that the consumer specifies when creating the VPC endpoint.

Resource-level sharing adds a second path. A resource configuration represents a single resource such as a database, a group of resources or a segment of a network, and the provider shares it through an AWS Resource Access Manager resource share to allow specific principals in another account to connect. Resource configurations can be associated with a service network that principals reach through a service-network VPC endpoint.

None of that is free by default, and the page reviewed does not price it. The architecture decision and the cost decision are the same decision here: every workload moved off a NAT gateway and onto an endpoint removes a per-gigabyte processing charge, and adds whatever the endpoint itself costs, which the buyer has to obtain as a number rather than assume.

Where the saving is real and where it is not

The clearest case is S3 traffic from inside a VPC. AWS's own example routes a 1 GB upload through a NAT gateway and then notes that setting up a gateway-type VPC endpoint and routing the traffic to S3 through it avoids the data processing charge, because gateway endpoints carry no data processing or hourly charge. At 10 TB a month, that is 10,240 GB of processing removed from the bill at $0.045 per GB, before any hourly line is considered.

The case is weaker where the destination is the public internet. Traffic that leaves for a non-AWS location incurs a data transfer out charge, and a private endpoint does not exist for an arbitrary internet destination. A NAT gateway remains the mechanism, and the lever is volume and placement rather than substitution.

The case is also weaker where the endpoint itself is priced per hour and per gigabyte and the volume is low. A team running a handful of gigabytes a month through a NAT gateway pays cents in processing and should be looking at the hourly line and the AZ count, not at re-architecting around endpoints.

The regional NAT gateway sits in between. It buys availability across Availability Zones and charges for each AZ it is configured in, so the comparison against three zonal gateways is close to a wash on the hourly line and turns on operational overhead rather than price.

The decision rule for the next architecture review

Choose a gateway VPC endpoint for S3 if the workload already sends internal traffic to S3 buckets in the same region, because AWS states there are no data processing or hourly charges for gateway endpoints and its own example removes the $0.045 per GB processing line by routing through one.

Choose a zonal NAT gateway if the workload needs a route to arbitrary internet destinations and the volume is modest, because the $0.045 hourly charge is the dominant cost at low throughput and the per-gigabyte line only bites as traffic grows. Choose the regional NAT gateway instead if the workload genuinely spans three Availability Zones and the operational simplicity is worth three NAT gateway-hours an hour, because that is what AWS bills for a regional gateway across three AZs.

Wait before committing to PrivateLink interface endpoints if the endpoint rate has not been quoted, because the page reviewed publishes no hourly or per-gigabyte figure for them and the comparison against a NAT gateway cannot be closed without it. Ask the account team for the interface endpoint hourly charge and the data processing charge per GB in the target region, and run both against the same monthly volume before the design is frozen.