NAT Gateway & Data Transfer Calculator

Model NAT gateway hours, per-GB processing, internet egress tiers and cross-AZ chatter together — then see what VPC endpoints, an AZ-local topology, or simply deleting an idle gateway would save.

Prices verified 4 Aug 2026
Monthly NAT and data transfer cost
$534.55
$6,414.60 a year. Per-GB processing — volume through the gateway is the driver.
NAT gateway hours3 x $0.045/hr x 730 hrs — charged at zero traffic$98.55
NAT data processing5,000 GB x $0.045/GB$225.00
Internet egressTiered from $0.09/GB, after 100 GB free — stacks on top of NAT processing$171.00
Cross-AZ transferBoth directions at $0.01/GB — lands in EC2-Other on your bill$40.00
Total$534.55

What would actually reduce it

VPC endpoints for eligible traffic
$78.75/mo
Removes NAT processing on that share. Interface endpoints carry their own fee — see below.
Keeping traffic AZ-local
$40.00/mo
Topology change, not a config flag. Usually the largest single win.
Collapsing to one gateway
$65.70/mo
Trades AZ isolation for cost. Acceptable in dev, rarely in production.

What this model assumes

  • Internet traffic is charged twice, on purpose. Bytes leaving through a NAT gateway to the internet pay NAT processing and data transfer out. Calculators that charge one or the other understate this line by roughly half.
  • Cross-AZ is billed in both directions by default, because AWS charges the sender and the receiver $0.01/GB each. This charge appears as “EC2-Other” on a bill and is routinely mistaken for compute.
  • Interface VPC endpoints are not free. The endpoint saving shown above is gross — it removes NAT processing but adds the endpoint’s own hourly and per-GB charge, which we did not verify a rate for and therefore do not model. Gateway endpoints for S3 and DynamoDB genuinely are free, and that is where the saving is real.
  • List prices, US East (N. Virginia). Data transfer rates vary by region and by destination; a private-pricing agreement changes the egress tiers but not the NAT rates.
Rates used
  • Data transfer and NAT gateway source, read 4 Aug 2026

US East (N. Virginia) list prices, excluding any negotiated or committed-use discount. Your effective rate is lower if you have one.

Frequently asked questions

Why is my AWS NAT gateway so expensive?

Three charges stack. The gateway costs $0.045 an hour whether or not traffic flows, so three availability zones cost about $98 a month before a byte moves. Every GB through the gateway costs another $0.045 — including traffic to S3 and other AWS services, not just the internet. And internet-bound bytes pay data transfer out on top of that. Most calculators model one of the three.

How much does a NAT gateway cost per month?

A single NAT gateway costs about $32.85 a month in hourly charges alone (730 hours at $0.045). Data processing at $0.045 per GB is added on top, so a gateway handling 1 TB a month costs roughly $78, and one handling 10 TB costs roughly $483.

Do VPC endpoints save money on NAT gateway charges?

Gateway endpoints for S3 and DynamoDB are free and remove that traffic from the NAT gateway entirely — an unambiguous saving. Interface endpoints for other services carry their own hourly and per-GB charge, so they only pay off above a break-even traffic volume. This calculator shows the gross saving and says explicitly that the interface-endpoint fee is not modelled.

How much does cross-AZ data transfer cost in AWS?

One cent per GB, charged in both directions — so a GB sent from an instance in one zone to an instance in another costs two cents in total. It appears on a bill under "EC2-Other" rather than as a named line, which is why it is routinely mistaken for compute and left unexamined.

Is a NAT instance cheaper than a NAT gateway?

On paper, often yes — a small EC2 instance costs less than $32.85 a month and has no per-GB processing charge. In practice you take on patching, failover, and a single point of failure, and the instance still pays data transfer out. It is a reasonable choice for a development account and a poor one for production.

This prices one snapshot. The traffic moves every day.

Finitizer watches NAT processing, egress and cross-AZ transfer continuously across every account, attributes each charge to the workload causing it, and opens the Terraform PR for the endpoint or topology change. Read-only and keyless.