Paste a line item from your invoice and find what it bills for, across the Google Cloud services covered so far.
Cloud NAT Data Processing
Cloud NAT lets instances without external IP addresses reach the internet.
It bills for every gigabyte that passes through it, inbound as well as outbound. That is the detail that surprises people: downloads are charged too, and the NAT charge stacks on top of internet egress for outbound traffic.
Billed: Per gibibyte processed through the gateway, in BOTH directions, plus an hourly gateway charge. For Public NAT that charge grows with the number of VMs using it (capped at 32), and each NAT IP address bills hourly; Private NAT gateways bill a flat hourly rate.
What triggers this charge
- Container image pulls from Docker Hub, npm, PyPI, or any registry outside Google. On a cluster that pulls images on every deploy, this alone can dominate.
- OS package updates across a fleet of instances.
- Any private-subnet workload calling an external API, the response body is billed as processed data even though ingress from the internet is otherwise free.
- Continuous integration runners in a private subnet downloading dependencies on every build.
How to reduce it
Turn on Private Google Access
Google routes traffic to Google APIs and services, Cloud Storage included, through Private Google Access even when the VM uses Public NAT. For workloads whose external traffic is mostly Google services, this removes most of the charge for a one-line subnet setting.
Mirror your dependencies
Artifact Registry remote repositories fetch upstream images and packages once and cache them. Your nodes then pull from Artifact Registry, a Google API that Private Google Access reaches without going through NAT.
Check what is actually going through it
Enable NAT logging and look at the top destinations. It is frequently one noisy agent, one image pulled on a loop, or a health check nobody knew was external.
Rates
Sources and review
- Explanation reviewed:
- 1 Nov 2026, against Cloud NAT pricing and the Cloud NAT overview.
- Rates verified:
- not yet. No rate is shown on this page until one is loaded from the Cloud Billing Catalog API.
- Billing SKU IDs mapped:
- 8515-9425-D2CE, 015F-5732-FFF0, 32E2-4EFC-EF9F, 6B7A-B4EC-BCA5, AAF7-1D17-BFC4
Related charges
Now find out how much of this you are actually paying.
Finitizer breaks your Google Cloud bill down to the SKU, shows how each one has moved since last week, and separates rate changes from usage changes, so you know whether to talk to engineering or to procurement.
See how Finitizer works