Cloud NAT Data Processing
Cloud NAT lets instances without external IP addresses reach the internet, and bills for every gigabyte that passes through it — inbound as well as outbound. That is the detail that surprises people: downloads are charged too, and the NAT charge stacks on top of internet egress for outbound traffic.
Billed: Per gibibyte processed through the NAT gateway, in BOTH directions, plus an hourly charge per gateway.
What triggers this charge
- Container image pulls from Docker Hub, npm, PyPI, or any registry outside Google. On a cluster that pulls images on every deploy, this alone can dominate.
- OS package updates across a fleet of instances.
- Any private-subnet workload calling an external API — the response body is billed as processed data even though ingress from the internet is otherwise free.
- Continuous integration runners in a private subnet downloading dependencies on every build.
How to reduce it
Turn on Private Google Access
Traffic to Google APIs and Cloud Storage can bypass NAT entirely. For workloads whose external traffic is mostly Google services, this removes most of the charge for a one-line subnet setting.
Mirror your dependencies
Artifact Registry remote repositories cache upstream images and packages inside Google. The first pull crosses NAT, the rest do not.
Check what is actually going through it
Enable NAT logging and look at the top destinations. It is frequently one noisy agent, one image pulled on a loop, or a health check nobody knew was external.
Rates
Related charges
Now find out how much of this you are actually paying.
Finitizer breaks your Google Cloud bill down to the SKU, shows how each one has moved since last week, and separates rate changes from usage changes — so you know whether to talk to engineering or to procurement.