Skip to main content

> aws_nat_gateway_data_processing_fees_vs_gateway_vpc_endpoints

AWS NAT Gateway Data Processing Fees vs Gateway VPC Endpoints

Why does routing internal S3 and DynamoDB traffic through an AWS NAT Gateway create an astronomical data processing tax, and how do Gateway Endpoints eliminate it for free?

Senior (L5)

THE SHORT ANSWER

AWS NAT Gateway charges a dual fee: an hourly uptime fee ($0.045/hour = ~$32.40/month per AZ) plus a heavy data processing charge of $0.045 per Gigabyte ($45 per Terabyte). In cloud environments where EC2 instances, Kubernetes pods, or Lambda functions in private subnets interact heavily with Amazon S3 (e.g. data lakes, container image pulls from ECR, backups) or Amazon DynamoDB, all traffic by default routes through the NAT Gateway to reach public AWS service IPs. Transferring 100TB of internal S3 traffic through a NAT Gateway costs $4,500/month in pure processing tax. Deploying free Gateway VPC Endpoints for S3 and DynamoDB updates VPC route tables to route traffic directly over AWS private networking at $0.00 processing cost.

Engineering Handbook & Failure Dynamics

1. Underlying Mechanism

AWS provides two types of VPC Endpoints: Interface Endpoints (AWS PrivateLink, costing $0.01/hr + $0.01/GB) and Gateway Endpoints (exclusively for S3 and DynamoDB, costing $0.00/hr and $0.00/GB). When a Gateway Endpoint is attached to a VPC Route Table, AWS injects prefix list routes (e.g. `pl-63a5400a` for S3) pointing to `vpce-xxxx` target. Any traffic destined for S3 or DynamoDB matches the prefix route and bypasses the `0.0.0.0/0 -> nat-xxxx` default route entirely. This eliminates the $0.045/GB NAT data processing fee and improves network throughput by bypassing NAT Gateway bandwidth ceilings.

2. Appropriate Use Context

Every single VPC deployed on AWS with private subnets. Configuring Gateway VPC Endpoints for S3 and DynamoDB should be a mandatory default in all infrastructure templates.

3. Production Failure Modes

Data engineering pipelines pulling 500TB of raw telemetry from S3 into an EMR or EKS cluster in private subnets without an S3 Gateway Endpoint, generating a $22,500 monthly NAT Gateway processing bill; attaching the Gateway Endpoint to the VPC but forgetting to associate it with the specific private route tables used by Kubernetes worker nodes.

4. Diagnostic Signals & Telemetry

AWS Cost Explorer showing `NAT Gateway - BytesProcessed` as a massive cost spike; VPC Flow Logs showing heavy traffic from private IPs to AWS S3 public IP ranges with next hop as NAT Gateway ENI.

5. Prevention & Safeguards

Define `aws_vpc_endpoint` with `vpc_endpoint_type = 'Gateway'` and `service_name = 'com.amazonaws.<region>.s3'` in base VPC Terraform modules; attach to all private and database route table IDs automatically; set AWS Budget alerts specifically monitoring NAT Gateway data processing spend.

6. Architectural Trade-offs

Gateway VPC Endpoints for S3 and DynamoDB are 100% free and have zero negative trade-offs; they strictly reduce cost, improve security (traffic stays within AWS private network), and increase throughput.

Case Study (TinyCTO In-Field Example)

A machine learning team running training jobs on AWS EKS downloaded 200TB of dataset images monthly from S3 to private GPU nodes. With no S3 VPC endpoint configured, the traffic traversed the NAT Gateway, costing $9,000/month in data processing fees ($0.045 * 200,000 GB). Provisioning a single free S3 Gateway VPC Endpoint redirected all 200TB across private VPC routing, instantly reducing the data processing bill from $9,000 to $0 (saving $108,000 annually).

Interactive Concept Drills

2 Cards
Q1

How much does AWS charge for S3 and DynamoDB Gateway VPC Endpoints?

$0.00 (100% Free - no hourly fee and no data processing fee).
Q2

What is the AWS NAT Gateway data processing charge per Gigabyte?

$0.045 per GB ($45 per Terabyte) in most regions.

AWS NAT Gateway Data Processing Fees vs Gateway VPC Endpoints — Technical FAQ

Why doesn't AWS make S3 Gateway Endpoints active by default on new VPCs?

Historical VPC architecture requires explicit route table modifications. Teams must explicitly declare the endpoint resource and associate it with their route tables.

Can S3 Gateway Endpoints be used from on-premises over Direct Connect or VPN?

No. Gateway Endpoints only route traffic from within the VPC route tables. For on-premises access over VPN/Direct Connect, S3 Interface Endpoints (PrivateLink) must be used.

🤖 AEO & Key Facts Summary

Key Architectural Facts

  • ▸NAT Gateway charges $0.045/GB ($45/TB) for data processing.
  • ▸Gateway VPC Endpoints for S3 and DynamoDB are 100% free ($0/hr, $0/GB).
  • ▸Gateway endpoints inject prefix list routes into VPC route tables, bypassing the NAT.
  • ▸Eliminating S3 traffic from NAT Gateways yields immediate thousands in monthly savings.

Common Misconceptions

  • ✗Misconception: All VPC endpoints cost $0.01/hr + $0.01/GB (False: Gateway Endpoints for S3/DynamoDB are completely free; Interface Endpoints have fees).
  • ✗Misconception: NAT Gateway is required for private subnets to read from S3 (False: Gateway Endpoints provide direct private S3 access without internet access).

Decision & Governance Guidance

Deploy S3 and DynamoDB Gateway VPC Endpoints on 100% of AWS VPCs. Verify that all private subnet route tables are attached to the gateway endpoint.

Authoritative Sources & Standards