Build1 publisher3 min readPublished
A free S3 gateway endpoint takes private-subnet traffic off the $0.045-a-GB NAT path
A dev.to post pins outsized AWS bills on NAT gateway data-processing fees and prescribes VPC endpoints. Its own rates put the break-even at 629 GB a month for one interface endpoint in one availability zone.
The Engineer · Build desk
What happened
- A dev.to post prices an AWS NAT gateway in us-east-1 at $0.045 per hour per availability zone plus $0.045 for every GB processed, using rates it dates to April 2026.
- That per-GB fee applies to every GB crossing the gateway, including traffic from a private subnet to S3 in the same region.
- For a typical 8-vCPU production workload talking to S3, RDS and a few third-party APIs, the post puts NAT charges at $400 to $1,800 a month, on a compute bill often less than half of that.
- It says combining VPC endpoints, IPv6 egress and a right-sized NAT topology takes a 10 TB per month workload from about $1,450 to under $400.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision Anyone applying the post's endpoint rule of thumb has to settle their zone count first, because the same interface endpoint running in three zones needs roughly three times the traffic before it beats NAT.
- contradiction The post's own two rates account for well under half of its $1,450 headline figure, so a team adopting that number as a savings target is importing traffic charges it cannot see.
- constraint The IPv6 route is the cheapest fix and the only one that needs a re-addressed VPC, so it is available to greenfield builds and is a project for everyone else.
- cost For every month the S3 and DynamoDB gateway endpoints stay off, the per-GB fee on that traffic is a straight loss, and switching them on needs no budget approval.
Without an endpoint, a pod in a private subnet calling S3 takes the default path: pod, NAT gateway, internet, then the AWS service. The dev.to post says you pay NAT data processing plus standard egress on that traffic, even though both ends sit inside AWS's network [5]. A gateway endpoint for S3 or DynamoDB keeps it on the AWS backbone at no charge, and the post's advice is to enable those on day one [6].
One gateway's hourly fee is $32.85 a month [2]. At $0.045 a GB, data processing passes it at 730 GB through that gateway [9].
Interface endpoints are the part that depends on your zone count. They cost $0.01 per availability zone per hour, about $22 a month, plus $0.01 a GB [7]. Every GB moved off NAT therefore saves $0.035 [4]. One endpoint in one zone breaks even at 629 GB a month [5], which is where the post's roughly 700 GB rule of thumb comes from [8]. Run the same endpoint in three zones and the fixed cost is $66, so break-even moves to 1,886 GB [6].
The 10 TB example does not reconcile. The post puts NAT at $1,450 a month for a Series A SaaS pushing 10 TB, against compute that may be $600 [13]. Ten thousand GB at $0.045 is $450 [1]. Three gateways of hourly fees add $98.55 [2]. Add them and you get $548.55, 38 percent of the stated total [3]. The post names two NAT pricing dimensions and does not give a rate for the standard egress it says the same traffic also incurs [16], so the remaining $900 cannot be rebuilt from what is on the page.
The instance case is strongest at the small end. A single-zone gateway carrying 500 GB costs $32.85 in hourly fees plus $22.50 in processing, or $55.35 a month, against about $3 of compute for the t4g.nano the post recommends [7]. The saving is roughly $628 a year, which will not buy much of an on-call rotation for the patching, monitoring and HA you have just taken on [12].
The $400 to $1,800 range is an estimate for a described workload, not a bill anyone published [4]. For it to describe yours, most of your NAT GB have to be headed for in-region AWS services, since that is the only share an endpoint can move. Calls to Stripe, GitHub, Slack, OpenAI and Anthropic go out through NAT unless you route them over IPv6, which the post says those APIs support [11]. The egress-only internet gateway for that has no hourly fee, no data-processing fee and no egress fee [9], and reaching it means enabling IPv6 on the VPC, which the post says most teams have not dual-stacked [10].
What to watch
- Whether AWS moves the $0.045 per GB data-processing rate or the free status of S3 and DynamoDB gateway endpoints in a later price list; the post's figures are dated April 2026 for us-east-1.
- Whether anyone publishes a Cost Explorer breakdown of a real 10 TB NAT month, which would show what the $900 the post does not itemise actually is.
- Whether the fck-nat hardened instance image gets an HA story good enough for the 3-AZ production case, which the post concedes to the managed gateway.