~$32-45/mo each, plus data processing

AWS NAT Gateway cost optimization

NAT Gateways bill by the hour and by the gigabyte, per Availability Zone. Idle gateways and traffic that never needed a NAT are one of the most common silent line items on an AWS bill.

Why the waste happens

  • A NAT Gateway costs roughly $0.045/hour (about $32/month) just to exist, before any data-processing charges.
  • Teams provision one per Availability Zone for high availability, then keep all of them after the workload shrinks or moves.
  • S3 and DynamoDB traffic is routed through the NAT (billed per GB) when a free Gateway VPC Endpoint would carry it at no cost.
  • Gateways are left running long after the private subnets behind them stop needing outbound internet.

How to spot it

  • Gateways with very low bytes-processed and near-zero active connections over the last few weeks.
  • More than one NAT Gateway in a VPC where high availability is not actually required (for example, dev and test).
  • High data-processing charges on buckets or tables that could use an S3/DynamoDB gateway endpoint.
  • NAT Gateways attached to subnets whose instances are all stopped or terminated.

The fix

  • Delete NAT Gateways with no meaningful traffic; they bill whether or not anything flows through them.
  • Consolidate to a single NAT Gateway per VPC where cross-AZ resilience is not required.
  • Add free S3 and DynamoDB gateway VPC endpoints so that traffic bypasses the NAT and its per-GB charge.
  • For low-traffic dev environments, consider a small NAT instance instead of a managed NAT Gateway.

Find every NAT Gateway issue in one scan

Cloud Cost Analyzer flags idle NAT Gateways using bidirectional traffic and connection metrics (not just a single counter), estimates the monthly waste for each, and points out traffic that a gateway endpoint could carry for free.

$ cca scan --provider aws

Read-only, runs in about 5 minutes. Free tier, no credit card.

Read the deep dive: Idle NAT Gateways: the quiet line item →

NAT Gateway cost FAQ

How much does an AWS NAT Gateway cost per month?+

A NAT Gateway is billed at about $0.045 per hour, which is roughly $32 per month per gateway, plus a per-gigabyte data-processing charge (about $0.045/GB) on all traffic that passes through it. Running one per Availability Zone multiplies the hourly cost.

How do I reduce NAT Gateway data-processing charges?+

Add free S3 and DynamoDB gateway VPC endpoints so that traffic to those services bypasses the NAT Gateway entirely. For other traffic, consolidate gateways and remove any that are idle.

Is it safe to delete an idle NAT Gateway?+

If no instances in the private subnets need outbound internet, deleting the gateway only removes the charge. Confirm there is no active outbound traffic first. Cloud Cost Analyzer identifies gateways with no meaningful traffic so you can verify before removing them.

More cost guides

RDS databases

Over-provisioned classes, non-Graviton, and Multi-AZ on non-prod.

EBS volumes

Orphaned volumes, old snapshots, and gp2 you never moved to gp3.

Load balancers

ALBs and NLBs with no targets or near-zero traffic, still billing.

S3 storage

Cold data sitting in Standard with no lifecycle policy.

EC2 instances

Idle and oversized instances, previous-gen types, 24/7 dev boxes.

Aurora

Oversized instances, Serverless v1, and I/O-Optimized breakevens.

ElastiCache

Idle cache clusters and oversized, non-Graviton nodes.

CloudFront

Idle distributions and price classes wider than your audience.

DynamoDB

On-demand billing on steady workloads, and unused indexes.

Lambda

Over-provisioned memory and x86 functions that could be arm64.

See what you are overpaying for

Point a read-only CLI at your account and get a ranked fix list with dollar amounts. Free tier, no credit card.