AWS VPC Support
Reduce AWS NAT gateway costs.
NAT gateways charge by the hour and again for every gigabyte they process, so a chatty private subnet can quietly cost more than the servers behind it. We trace which traffic uses the NAT gateway and send it a cheaper way.
When You Need This
The situations where this work pays for itself.
Signs it is time
- NatGateway-Bytes is a top line in your bill
- Containers pull images from ECR through a NAT gateway
- Large S3 or DynamoDB traffic leaves private subnets
- You run one NAT gateway per AZ in non-production
- You see surprise data transfer charges after a launch
What you get
- A traffic attribution report for your NAT gateways
- Endpoint and routing changes as infrastructure as code
- Estimated and measured monthly savings
- Alarms on NAT data processed
How we do it
A clear, safe process you can follow along with.
1. Find where the bytes go
We use VPC Flow Logs, NAT gateway metrics and Cost Explorer to attribute traffic to subnets, instances and destinations.
2. Add gateway endpoints
S3 and DynamoDB gateway endpoints take that traffic off the NAT gateway at no hourly charge.
3. Add interface endpoints where they pay off
For heavy use of services like ECR, CloudWatch Logs or Secrets Manager, interface endpoints can cost less than NAT processing. We compare before adding them.
4. Fix chatty applications
Large downloads, polling loops and package installs at runtime are moved to caches, mirrors or build time.
5. Right-size the NAT layout
We balance cost against resilience, for example one NAT gateway for non-production and one per AZ for production.
6. Verify the savings
We compare NAT bytes and cost before and after and set an alarm for regression.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Removing NAT in production for savings
Resilience matters. We keep per-AZ NAT where availability requires it.
Adding endpoints blindly
Interface endpoints have an hourly cost per AZ. We only add those that the traffic justifies.
Overlooking cross-AZ traffic
Routing through a NAT in another AZ adds data transfer charges. We align routes by AZ.
Frequently Asked Questions
Why is my NAT gateway so expensive?
You pay per hour and per GB processed. Large image pulls, S3 traffic and software downloads from private subnets are common causes.
Are S3 gateway endpoints free?
Yes. Gateway endpoints for S3 and DynamoDB have no hourly or data processing charge, though normal S3 request charges still apply.
Can I remove the NAT gateway?
Only if nothing in private subnets needs outbound internet access. Endpoints can replace it for AWS services.
Want Help With Reduce AWS NAT gateway costs?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required