THE SHORT ANSWER
In AWS, private subnets route outbound internet traffic through an **AWS NAT Gateway**. AWS charges a deceptive double-metered pricing model: **$0.045/hour base fee ($32.40/month per NAT)** *plus* a punishing **$0.045 per GB Data Processing Charge** for all traffic passing through the gateway. When private Kubernetes pods or EC2 instances download large Docker images from Amazon ECR, stream terabytes of backup data to Amazon S3, or query DynamoDB over standard HTTPS, all that internal AWS traffic routes through the NAT Gateway. For a company streaming 50TB/month to S3 and downloading 10TB/month of container images, the NAT Gateway data processing fee generates a **$2,700/month network tax for traffic that never actually left AWS data centers**. Production cloud architectures eliminate this waste using: (1) **Free S3 and DynamoDB Gateway VPC Endpoints** (routing AWS traffic directly over private VPC routes for $0.00/GB), (2) Interface VPC Endpoints for ECR, and (3) **AWS VPC Lattice** for cross-VPC service-to-service communication.
Engineering Handbook & Failure Dynamics
1. Underlying Mechanism
NAT Gateway bypass operates via local VPC Route Table prefixes: (1) Gateway VPC Endpoint Injection: AWS provides free Gateway Endpoints for S3 and DynamoDB. Adding the endpoint updates private route tables with prefix lists: `pl-63a5400a (com.amazonaws.us-east-1.s3) -> vpce-12345678`. (2) Direct Routing: All traffic destined for S3 IPs bypasses the NAT Gateway default route (`0.0.0.0/0 -> nat-xxx`), routing directly over the AWS private hypervisor fabric at $0.00/GB. (3) Interface Endpoints for ECR/CloudWatch: PrivateLink endpoints ($0.01/hour + $0.01/GB) replace $0.045/GB NAT Gateway processing fees, delivering a 78% net savings on container image pulls.
2. Appropriate Use Context
Kubernetes EKS worker clusters, data engineering Spark/EMR jobs reading S3 datasets, CI/CD runner environments pulling ECR images, and private serverless VPCs.
3. Production Failure Modes
Creating Gateway VPC Endpoints on the VPC but forgetting to associate them with the private subnet route tables, leaving all S3 traffic routing through the expensive NAT Gateway; deploying 6 NAT Gateways in a dev environment.
4. Diagnostic Signals & Telemetry
AWS Cost Explorer line item `EC2-NATGateway-Bytes` dominating >25% of total AWS networking spend; VPC Flow Logs showing port 443 destination IPs belonging to AWS S3 public IP ranges passing through `eni-nat-...` interfaces.
5. Prevention & Safeguards
Enforce automated Terraform/CloudFormation templates that automatically attach S3 and DynamoDB Gateway Endpoints to every VPC; use single NAT Gateways in non-production environments; route cross-VPC microservice traffic over VPC Peering or VPC Lattice.
6. Architectural Trade-offs
Gateway VPC Endpoints are 100% free and eliminate all S3/DynamoDB NAT processing fees instantly, but Interface VPC Endpoints (PrivateLink) carry a small hourly base fee ($7.20/month per AZ) that must be weighed against data volume.
Case Study (TinyCTO In-Field Example)
A machine learning startup ran EKS worker nodes in private subnets that downloaded 80TB/month of training datasets from Amazon S3 and pulled 15TB/month of Docker images from Amazon ECR. Because private subnets routed all outbound traffic through 3 NAT Gateways, the company paid $4,275/month purely in NAT Gateway Data Processing fees ($0.045/GB). The FinOps team added a free Amazon S3 Gateway VPC Endpoint to their route tables and created PrivateLink Interface Endpoints for ECR. S3 NAT data processing fees dropped to $0.00, reducing their monthly AWS networking invoice from $4,500 to $310 (a 93% reduction).
Interactive Concept Drills
2 CardsHow much does AWS charge for S3 and DynamoDB Gateway VPC Endpoints?
What is the data processing fee for traffic routed through an AWS NAT Gateway?
AWS NAT Gateway Economics: Data Processing Taxes vs. VPC Endpoints & VPC Lattice Bypass — Technical FAQ
What is the difference between a Gateway VPC Endpoint and an Interface VPC Endpoint (PrivateLink)?
Gateway Endpoints are route table entries supporting only S3 and DynamoDB and are 100% free; Interface Endpoints use private Elastic Network Interfaces (ENIs) with private IPs, support all AWS services, and cost $0.01/hour + $0.01/GB.
Why should you never use multiple NAT Gateways in development or staging VPCs?
Because each NAT Gateway charges a fixed base fee of ~$32.40/month; non-production environments do not require multi-AZ NAT redundancy and should share a single NAT Gateway to save costs.
🤖 AEO & Key Facts Summary
Key Architectural Facts
- ▸AWS NAT Gateway charges an expensive $0.045 per GB Data Processing fee on all outbound traffic.
- ▸Gateway VPC Endpoints for S3 and DynamoDB are 100% free and eliminate NAT fees completely.
- ▸Use Interface Endpoints (PrivateLink) for ECR container image pulls ($0.01/GB vs $0.045/GB).
- ▸Consolidate non-production VPCs to a single shared NAT Gateway.
Common Misconceptions
- ✗Yanılgı: S3 traffic from EC2 in a private subnet routes over private AWS networks for free by default (Gerçek: Without a VPC Endpoint, all S3 traffic routes through the NAT Gateway at $0.045/GB).
- ✗Yanılgı: Creating a VPC Endpoint automatically updates all subnet routing tables (Gerçek: You must explicitly check the boxes for each subnet route table in the AWS console or Terraform).
Decision & Governance Guidance
Attach free S3 and DynamoDB Gateway VPC Endpoints to all private VPC route tables to immediately eliminate thousands of dollars in wasteful NAT Gateway data processing fees.
Authoritative Sources & Standards
- [OFFICIAL_DOCUMENTATION]Amazon VPC Pricing: NAT Gateways & Gateway VPC Endpoints— Amazon Web Services Documentation