NAT Gateway vs VPC Endpoint Cost Calculator
See how much you save by moving S3, DynamoDB, and AWS-service traffic off NAT Gateway and onto free Gateway Endpoints and PrivateLink. us-east-1 list pricing.
- No signup
- Instant results
- ~2 min
Rates reviewed
Your NAT traffic mix
us-east-1list rates, pricing as of 2026-07-09. Source: AWS public pricing.
NAT processes every GB at $0.045. VPC Gateway Endpoints for S3 and DynamoDB are free.Interface Endpoints (PrivateLink) cost $0.01/hr per AZ plus $0.01/GB — cheaper than NAT for AWS-service traffic. We assume one NAT Gateway per AZ.
One NAT Gateway per AZ is the standard HA pattern. Also sets Interface Endpoint AZ count.
Traffic to S3 & DynamoDB via NAT
Moves to FREE Gateway Endpoints — this GB stops being billed by NAT entirely.
Traffic to other AWS services via NAT
Moves to Interface Endpoints at $0.01/GB instead of NAT's $0.045/GB.
e.g. ECR API, ECR DKR, Secrets Manager, SSM. Each billed hourly per AZ.
General internet egress via NAT
Real internet-bound traffic can't use endpoints. If this is 0, NAT can potentially be removed entirely.
Who This Tool Is For
Platform engineers, network architects, and FinOps leads whose NAT Gateway data-processing charge is climbing. If your private subnets pull container images from ECR, read secrets, or hit S3 all day, most of that NAT bill is avoidable.
Why We Built This Tool
NAT Gateway charges $0.045 for every GB it processes — including traffic to AWS services that never needs to touch the public internet. VPC endpoints keep that traffic on the AWS network: Gateway Endpoints (S3, DynamoDB) are free, and Interface Endpoints undercut NAT at $0.01/GB. This calculator quantifies the swap the way we do in client VPC reviews.
What Problem It Solves
- Free wins first. S3 and DynamoDB Gateway Endpoints remove that GB from NAT at zero cost — always worth doing.
- Break-even clarity. Interface Endpoints have an hourly fee, so see the GB volume where they beat NAT.
- Eliminate-NAT scenario. If nothing needs the public internet, endpoints can retire NAT entirely.
- Defensible numbers. Export-ready figures for the architecture and finance review.
Pair with the NAT Gateway and Data Transfer calculators, or roll it into the whole-bill calculator.
Frequently Asked Questions
What is the difference between a Gateway Endpoint and an Interface Endpoint?
Gateway Endpoints exist only for Amazon S3 and DynamoDB and are completely free — no hourly charge, no per-GB charge. Interface Endpoints (powered by AWS PrivateLink) work for most other AWS services and cost $0.01 per hour per Availability Zone plus $0.01 per GB processed. Both keep traffic on the AWS network instead of routing it through NAT.
Where do these prices come from?
AWS us-east-1 list rates as of 2026-07-09: NAT Gateway $0.045/hour per gateway and $0.045/GB processed; VPC Gateway Endpoints free; Interface Endpoints $0.01/hour per AZ and $0.01/GB. Confirm against the AWS VPC and PrivateLink pricing pages before budgeting.
When is an Interface Endpoint actually cheaper than NAT?
An Interface Endpoint adds a fixed ~$7.30/month per AZ ($0.01 × 730 hours) but drops processing from $0.045/GB to $0.01/GB — a $0.035/GB saving. So a 2-AZ endpoint pays for itself at roughly 420 GB/month of that service traffic. Below that, keep the traffic on NAT; above it, the endpoint wins.
Can VPC endpoints let me delete NAT Gateway entirely?
Only if nothing in your private subnets needs the public internet. Package downloads, third-party APIs, and webhooks still require NAT (or an egress-only path). If you set internet egress to 0 in this calculator, it models the full NAT elimination — including removing the hourly gateway charge.
Do endpoints change anything besides cost?
Yes — they also improve security posture by keeping AWS-service traffic off the public internet, and they can reduce latency. This tool models only the cost dimension; the security and reliability benefits are additional reasons the swap is standard practice.