Home › Decoder › NatGateway-Bytes: the NAT Gateway data-processing line

NatGateway-Bytes: the NAT Gateway data-processing line

NatGateway-Bytes is the charge for every gigabyte that passes through a NAT gateway, in either direction, billed at $0.045 per GB in US East (N. Virginia) on top of the hourly charge and any normal data-transfer charges.

In your bill the usage type reads: NatGateway-Bytes, USE1-NatGateway-Bytes

What it costs

Charge	Price	Unit
Data processed by the NAT gateway	$0.045	per GB
Same gateway, hourly charge (separate line: NatGateway-Hours)	$0.045	per hour

US East (N. Virginia); other regions differ. Checked 2026-11-04. Sources: AWS VPC pricing, AWS price list file, EC2 offer, us-east-1.

Example with made-up numbers

4,200 GB processed in the month x $0.045 = $189.00 on the NatGateway-Bytes line

If 60% of that traffic is to S3 or DynamoDB, a gateway endpoint (no additional charge) removes 2,520 GB x $0.045 = $113.40 of it

The other 1,680 GB still costs $75.60 until you find who sends it

Typical causes

Private instances pulling from S3 through the NAT

Every GB from a private subnet to S3 or DynamoDB via the NAT gateway is billed at $0.045. S3 and DynamoDB gateway endpoints have no additional charge, so this is the most common avoidable share.

Container image pulls and package installs

ECS, EKS or CI runners in private subnets pulling large images from a public registry or package mirror on every deploy and every autoscale event.

Logs and metrics shipped to an outside vendor

Agents sending logs, metrics or traces to a SaaS endpoint over the internet from private subnets. Volume scales with traffic, not with the number of servers.

Cross-service chatter through public endpoints

Services calling AWS APIs (ECR, SQS, Secrets Manager, STS) by their public endpoints from private subnets: each call's bytes are processed by the NAT.

The fix, step by step

Verify first

Check these before you change anything: the steps below are suggestions, and only you can see your own configuration.

Confirm which NAT gateway the bytes belong to: in Cost Explorer group by Usage type and then by Resource ID (CUR) or check the CloudWatch metric BytesOutToDestination / BytesOutToSource per NAT gateway before changing routes.
Turn on VPC Flow Logs for the NAT gateway's network interface for a day (this has its own cost) or use CloudWatch Contributor Insights on flow logs to see the top destinations. Do not guess the destination.
Check the route table of each private subnet: a gateway endpoint only attracts traffic for subnets whose route table it is attached to.
Look for policies or allow-lists that assume traffic leaves from the NAT's Elastic IP. S3 gateway endpoint traffic does not go out that address.

In the console

VPC console > Endpoints > Create endpoint.
Service category: AWS services; pick com.amazonaws.<region>.s3 with type Gateway (repeat for dynamodb if used).
Select the VPC and the route tables of the private subnets that reach S3; leave the default endpoint policy for the first test.
Create, then confirm each chosen route table shows a prefix-list route to the new vpce- target.
Watch NatGateway-Bytes for the next billing days in Cost Explorer (daily view) to confirm the drop.

With the CLI

aws ec2 describe-nat-gateways --query 'NatGateways[].[NatGatewayId,VpcId,SubnetId]'

aws ec2 create-vpc-endpoint --vpc-id vpc-EXAMPLE --service-name com.amazonaws.us-east-1.s3 --vpc-endpoint-type Gateway --route-table-ids rtb-EXAMPLE1 rtb-EXAMPLE2

aws ec2 describe-route-tables --route-table-ids rtb-EXAMPLE1 --query 'RouteTables[].Routes'

Rollback

Delete the endpoint (aws ec2 delete-vpc-endpoints --vpc-endpoint-ids vpce-EXAMPLE); traffic returns to the NAT route. Test in one non-production route table first.

Find NatGateway-Bytes in your own bill

Drop in your Cost Explorer or CUR CSV. Billtrim reads it in your browser, finds this line, and shows the dollars and the steps for your numbers.

See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Is NAT Gateway data processing charged both ways?

AWS bills data processed by the NAT gateway per GB regardless of source and destination of the traffic (AWS VPC pricing page). Standard data-transfer charges can apply on top.

Why does my bill show both NatGateway-Hours and NatGateway-Bytes?

They are two separate charges: an hourly charge for each NAT gateway that exists ($0.045 per hour in US East N. Virginia) and a per-GB processing charge.

Do gateway endpoints cost anything?

AWS documents that there is no additional charge for using gateway endpoints (S3 and DynamoDB).

Part of the guide: Reduce AWS NAT Gateway cost: six checks, in order