NAT Gateway vs S3 Gateway Endpoint: cost comparison with a worked example
A private EC2 fleet calling Amazon S3 through a NAT Gateway racks up a real, recurring bill for traffic that never leaves AWS's own network. Swapping in a Gateway VPC Endpoint for S3 removes that charge entirely. Most guides to this say so in one sentence and move on. This page runs the actual numbers, using AWS's own published rates, so you can see exactly where the savings come from and why they're larger than they first look.
How a NAT Gateway actually bills you
A NAT Gateway has two separate charges, both listed on AWS's own VPC pricing page: an hourly charge per Availability Zone the gateway runs in, and a per-gigabyte "data processing" charge on every byte that passes through it — in either direction. AWS's own published example rate is $0.045 per NAT Gateway-hour and $0.045 per GB processed (shown for US East, Ohio; most other US Regions use the same figures, but always check the pricing page for your own Region before budgeting).
The critical detail people miss: the $0.045/GB data processing charge applies even when the destination is another AWS service in the same Region, like S3. The NAT Gateway doesn't know or care that the traffic is "internal" — it just forwards packets and bills by the byte.
Worked example: 10 TB a month to S3 through a NAT Gateway
Suppose a fleet of EC2 instances in a private subnet uploads and downloads 10,000 GB (10 TB) a month to S3, routed through a single NAT Gateway in one Availability Zone, running continuously (730 hours in a 30.4-day month):
| Charge | Calculation | Monthly cost |
|---|---|---|
| NAT Gateway hourly charge | 730 hours × $0.045/hour | $32.85 |
| NAT Gateway data processing | 10,000 GB × $0.045/GB | $450.00 |
| Total | $482.85 |
At this traffic volume, data processing is more than 13 times the hourly charge. Double the traffic to 20 TB and the data-processing line doubles to $900, while the hourly charge stays fixed — which is why the processing fee, not the hourly fee, dominates the bill as S3 traffic grows.
The fix: a Gateway VPC Endpoint
AWS's own documentation states plainly that "there are no data processing or hourly charges for using Gateway Type VPC endpoints" (see the VPC pricing page above). A Gateway Endpoint doesn't add a network interface or appliance to the data path at all — it works by adding a special route to your subnet's route table that points S3-bound traffic (matched by a managed prefix list) directly onto AWS's internal network, bypassing the NAT Gateway, the internet gateway, and the public internet completely.
Re-running the same 10 TB/month scenario with a Gateway Endpoint for S3 in place of the NAT Gateway route:
| Route used for S3 traffic | Monthly cost for that traffic |
|---|---|
| Through the NAT Gateway | $450.00 (data processing only, since the hourly charge is shared with other traffic) |
| Through an S3 Gateway Endpoint | $0.00 |
That's a direct $450/month ($5,400/year) saving on this traffic alone. The NAT Gateway's $32.85 hourly charge only disappears too if nothing else in the subnet still needs general internet access through it — in most real VPCs, the NAT Gateway stays for other destinations, and the Gateway Endpoint just removes its single largest line item.
Why this doesn't work for every AWS service
Gateway Endpoints exist for exactly two services: Amazon S3 and Amazon DynamoDB. Every other AWS service — Secrets Manager, Kinesis, SQS, SNS, ECR, and dozens more — uses an Interface Endpoint instead, built on AWS PrivateLink. An Interface Endpoint is a genuinely different mechanism: it creates an elastic network interface with a private IP address in your subnet, and it is not free. AWS's published PrivateLink rate is about $0.01 per AZ-hour per endpoint plus $0.01 per GB processed (check the PrivateLink pricing page for current figures and tiered discounts above 1 PB/month).
Running the same 10 TB/month scenario against an Interface Endpoint spanning two Availability Zones instead of a Gateway Endpoint:
| Charge | Calculation | Monthly cost |
|---|---|---|
| Endpoint hourly charge (2 AZs) | 2 × 730 hours × $0.01/hour | $14.60 |
| Endpoint data processing | 10,000 GB × $0.01/GB | $100.00 |
| Total | $114.60 |
Still a large saving versus the $450 NAT Gateway data-processing bill for the same volume, but not free — a distinction the AWS cost optimisation practice questions test directly, and one of the most common mix-ups on this part of the exam: assuming "VPC endpoint" always means "free."
The setup step people skip
Creating a Gateway Endpoint has no effect on your bill by itself. Traffic only shifts off the NAT Gateway once the endpoint is associated with the route table used by the private subnet — AWS adds the prefix-list route automatically when you select that route table during creation, but it's easy to create the endpoint and forget to associate every route table that needs it (for example, a second private subnet in another AZ with its own route table). If S3 charges through the NAT Gateway don't drop after adding an endpoint, checking which route tables are actually associated with it is the first thing to verify.
Quick decision table
| Destination | Endpoint type | Hourly charge | Per-GB charge |
|---|---|---|---|
| S3 or DynamoDB | Gateway Endpoint | None | None |
| Everything else (PrivateLink-supported services) | Interface Endpoint | ~$0.01/AZ-hour | ~$0.01/GB |
| Any destination, routed through NAT | NAT Gateway | ~$0.045/AZ-hour | ~$0.045/GB |
Rates shown are AWS's own published example figures and change over time and by Region — always confirm current pricing on AWS's pricing pages before using these numbers for a real budget. For hands-on practice with this and the rest of AWS's networking and cost-optimisation material, try the VPC & Networking practice questions alongside the cost questions linked above.
Source: AWS VPC pricing (aws.amazon.com/vpc/pricing/), AWS PrivateLink pricing (aws.amazon.com/privatelink/pricing/), and the AWS VPC endpoints documentation (docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html).