Your AWS NAT gateway cost is the price of the service that lets servers without a public IP address reach the internet. According to AWS pricing on 28 October 2026, a gateway in us-east-1 costs USD 0.045 an hour, or about USD 33 a month. Every gigabyte it handles adds another USD 0.045, traffic to S3 included. In Frankfurt, used in the examples below, both rates are USD 0.052, and one gateway with its public IPv4 address comes to about USD 42 a month before the first byte goes through it.
In Cost Explorer, filter to EC2-Other, group by Usage type and compare NatGateway-Hours with NatGateway-Bytes. Outside us-east-1 both names start with a Region code, EUC1- in Frankfurt. If the hours cost more, look for gateways to delete; if the bytes do, look for the server sending the most data.
A NAT gateway costs money before the first byte
AWS bills every hour a gateway is provisioned and available, and a partial hour counts as a full one. In Frankfurt that is about USD 38 a month. The gateway’s public IPv4 address adds USD 3.65 a month.
For production, AWS recommends a NAT gateway in each Availability Zone whose resources need the internet. Across three zones that is about USD 125 a month before any traffic.
A gigabyte to the internet costs USD 0.142 through the gateway
AWS applies the USD 0.052 processing fee to every gigabyte that passes through the gateway, whatever its source or destination. Traffic to the internet is then charged standard data transfer on top: USD 0.09 per GB in Frankfurt once the 100 GB of free transfer each month is used up. That gigabyte ends up at USD 0.142.
A server in a different Availability Zone from its gateway pays another USD 0.01 per GB for the traffic between them. Traffic within one zone is free, so keep data-heavy servers in their gateway’s zone.
Finding what sends traffic through the gateway
To find which gateway carries the traffic, compare the gateways’ CloudWatch metrics BytesOutToDestination and BytesInFromDestination with the Sum statistic.
The server behind it shows up in VPC Flow Logs. According to AWS re:Post, it is enough to send them from the gateways’ network interfaces to CloudWatch Logs. They are billed and record nothing from before you enable them, so leave them on for a few working days, then switch them off.
In CloudWatch Logs Insights, run the article’s query on that log group. Replace the example addresses with your gateways’ private addresses, listed under NAT gateways in the VPC console, and your VPC’s CIDR range.
filter (dstAddr in ["10.0.1.25", "10.0.2.25", "10.0.3.25"]
AND isIpv4InSubnet(srcAddr, "10.0.0.0/16"))
OR (srcAddr in ["10.0.1.25", "10.0.2.25", "10.0.3.25"]
AND isIpv4InSubnet(dstAddr, "10.0.0.0/16"))
| stats sum(bytes) as bytesTransferred by srcAddr, dstAddr
| sort bytesTransferred descIn the top rows, look up the address that is not a gateway under Network Interfaces in the EC2 console, which also lists ECS tasks and Lambda functions.
Traffic to S3 in the same Region can bypass the gateway through a gateway endpoint, which has no charge. My post on EC2-Other shows how to add one and what to check in bucket policies first. The same endpoint also takes most of an ECR image pull off the gateway, because according to the ECR documentation the image layers are downloaded from S3. If the endpoint has its own policy, it must allow the ECR layer bucket.
NAT gateways nobody uses
Since November 2025 Compute Optimizer has flagged NAT gateways that have had no traffic for 32 days, and since February 2026 Trusted Advisor has done the same. Trusted Advisor’s cost checks, though, are not included in the Basic or Developer Support plans, so on those plans use Compute Optimizer, which you opt in to once per account.
Without those tools, check two CloudWatch metrics over the last 32 days: the maximum of ActiveConnectionCount and the sum of BytesOutToDestination. The first counts only TCP connections, so only zero on both means nobody is using the gateway.
Before you delete a gateway, point the route tables that use it at another gateway or remove those routes; otherwise they stay as blackhole routes and those subnets lose their way out to the internet. AWS also does not release the gateway’s Elastic IP address from your account, so it keeps costing USD 3.65 a month as an idle address. Release it once you know nobody has it on an allowlist, for example at a payment provider.
NAT instance vs NAT gateway
An EC2 instance can do the gateway’s job, but the NAT AMI from AWS runs on Amazon Linux 2018.03, unsupported since 2023, so build your own on Amazon Linux 2023 and turn off its source/destination check. AWS’s comparison recommends the gateway for availability and less upkeep, but an instance is billed only by type and hours, with no per-GB processing charge. Internet and cross-zone transfer cost the same either way.
In Frankfurt, a gateway with its public address costs about USD 42 a month without traffic, and a t4g.micro instance with its address and disk about USD 11. With 1 TB a month through it, the gateway comes to about USD 95, while the instance stays at about USD 11.
A single instance has no automatic failover, so if it stops, your private servers lose internet access until someone restarts it. Small t4g instances reach full network speed only in short bursts on network credits; once those run out, they drop back to their baseline bandwidth. Patching the system is also your job, and every reboot cuts your private servers off the internet.
An instance suits test and development environments, or a few servers with little outbound traffic. If losing outbound internet access would stop orders or payments, keep the gateway in production. Either way, move S3 traffic to the free gateway endpoint first, because that needs no extra server.
What it means for a small team
Delete idle gateways together with their addresses first. When NatGateway-Bytes grows, find the source with the query above before adding an endpoint for the AWS service that receives the most data.
Instead of clicking through Cost Explorer, you can load an export of the whole bill grouped by Usage type into the CSV analysis. When NAT and transfer are a significant part of the bill, it shows gateway hours, processed data and internet transfer separately.
Every gateway that has carried nothing for 32 days is about USD 42 a month in Frankfurt that you get back by deleting it and releasing its address.
3 ways I can help
- How to set up AWS budget alerts
Read this post next.
- AWS cost audit
An AWS cost audit at a fixed price per package. You get a list of changes with a saving figure next to each, and I only need read-only access to the account.
- Email me
Or directly to jacob@codelevel.pl. I reply within 1 business day.