NAT Gateway & Data Transfer Calculator
See what your NAT gateways and data transfer cost each month, and what VPC endpoints would save.
Each one fills in the fields below for a typical workload of that kind. You can change any of them.
- Charged whether traffic flows or not
- $98.55
- Removable with gateway endpoints
- $78.75/mo
- Cross-AZ transfer
- $40.00
$6,414.60 a year at these inputs.
| NAT gateway hours3 x $0.045/hr x 730 hrs, charged at zero traffic | $98.55 |
| NAT data processing5,000 GB x $0.045/GB | $225.00 |
| Internet egressTiered from $0.09/GB, after 100 GB free, stacks on top of NAT processing | $171.00 |
| Cross-AZ transferBoth directions at $0.01/GB, lands in EC2-Other on your bill | $40.00 |
| Total | $534.55 |
What would actually reduce it
Make the change
The endpoint saving on this page assumes a share of your NAT traffic is bound for AWS services. Measure that share first, then add the endpoints that carry it.
Top destinations by bytes, from VPC flow logs. Read-only, and it costs a Logs Insights scan. Run it before adding interface endpoints: they carry an hourly charge per zone and are a loss on traffic that turns out to be small.
# Which destinations your NAT traffic is actually going to, so the
# endpoint-eligible share on this page can be replaced with a measurement.
# VPC flow logs must already be enabled on the NAT gateway ENIs.
# 1. The NAT gateway's own network interface, so the query counts only it.
NAT_ENI=$(aws ec2 describe-nat-gateways --nat-gateway-ids nat-xxxxxxxx \
--query 'NatGateways[0].NatGatewayAddresses[0].NetworkInterfaceId' --output text)
# 2. Start the query over the last 7 days. Plain arithmetic on epoch
# seconds, so it runs on macOS and Linux alike.
NOW=$(date +%s)
QUERY_ID=$(aws logs start-query \
--log-group-name /aws/vpc/flowlogs \
--start-time $((NOW - 7 * 24 * 3600)) \
--end-time "$NOW" \
--query-string "fields dstAddr, bytes
| filter interfaceId = '$NAT_ENI'
| stats sum(bytes) as total by dstAddr
| sort total desc
| limit 50" \
--query queryId --output text)
# 3. Fetch the results (re-run until status is Complete).
aws logs get-query-results --query-id "$QUERY_ID"What this model assumes
Show
- Internet traffic is charged twice, on purpose. Bytes leaving through a NAT gateway to the internet pay NAT processing and data transfer out. Calculators that charge one or the other understate this line by roughly half.
- Cross-AZ is billed in both directions by default, because AWS charges the sender and the receiver $0.01/GB each. This charge appears as “EC2-Other” on a bill and is routinely mistaken for compute.
- The endpoint saving is for S3 and DynamoDB. Their gateway endpoints are free, so the saving is real. Interface endpoints for other services (ECR, Secrets Manager and so on) cost $0.01 an hour in each zone and $0.01 a GB, which on small traffic is more than the NAT processing they replace.
- Collapsing gateways creates cross-AZ traffic. With traffic spread evenly across zones, everything from the zones that lose their gateway, (N - 1)/N of it, crosses a zone boundary to reach the one that is left, at the cross-AZ rate. The collapse figure above is net of that.
- List prices, US East (N. Virginia). Data transfer rates vary by region and by destination; a private-pricing agreement changes the egress tiers but not the NAT rates.
Rates used and their sourcesShow
- Data transfer, NAT gateway and public IPv4, source, read 13 Oct 2026
Prices verified 13 Oct 2026. Public list prices in USD for US East (N. Virginia), before any discount you have negotiated.
Want this done on your real bill?
Cloud Cost Audit: We go through your real AWS or Google Cloud bill and hand you a ranked list of what to cut first. From $1,500, fixed. Nothing paid upfront.
Questions
Why is my AWS NAT gateway so expensive?
Three charges stack. The gateway costs $0.045 an hour whether or not traffic flows, so three availability zones cost $98.55 a month before a byte moves. Every GB through the gateway costs another $0.045, including traffic to S3 and other AWS services, not just the internet. And internet-bound bytes pay data transfer out on top of that. Most calculators model one of the three.
How much does a NAT gateway cost per month?
A single NAT gateway costs about $32.85 a month in hourly charges alone (730 hours at $0.045). Data processing at $0.045 per GB is added on top, so a gateway handling 1,000 GB a month costs about $77.85, and one handling 10,000 GB about $482.85, before any internet egress.
Do VPC endpoints save money on NAT gateway charges?
Gateway endpoints for S3 and DynamoDB are free and remove that traffic from the NAT gateway entirely, an unambiguous saving. Interface endpoints for other services cost $0.01 an hour in each zone and $0.01 a GB, so they only pay off above a break-even traffic volume: in three zones, about 630 GB a month. This calculator prices the S3 and DynamoDB share, the saving you can count on.
How much does cross-AZ data transfer cost in AWS?
One cent per GB, charged in both directions, so a GB sent from an instance in one zone to an instance in another costs two cents in total. It appears on a bill under "EC2-Other" rather than as a named line, which is why it is routinely mistaken for compute and left unexamined.
Is a NAT instance cheaper than a NAT gateway?
On paper, often yes, a small EC2 instance costs less than $32.85 a month and has no per-GB processing charge. In practice you take on patching, failover, and a single point of failure, and the instance still pays data transfer out. It is a reasonable choice for a development account and a poor one for production.
Related tools
Kubernetes Cost Calculator
Size nodes from your pod requests, then price everything nodes leave out.
OpenCloudFront vs S3 Direct Calculator
Average object size decides this more than cache hit rate.
OpenEC2 Idle & Rightsizing Calculator
What idle instances cost, and what stopping them actually saves.
OpenMore tools for: Network and data transfer
This prices one snapshot. The traffic moves every day.
Finitizer watches NAT processing, egress and cross-AZ transfer continuously across every account, attributes each charge to the workload causing it, and opens the Terraform PR for the endpoint or topology change. Read-only and keyless.
See how Finitizer works