All posts
Cost Optimization

NAT Gateway Costs in 2026: Regional NAT, Public IPv4 Charges and the Endpoints That Cut the Bill

By

October 25, 2026

7 min read

AWS's regional NAT gateway simplifies multi-AZ networking but costs the same per hour. The savings are elsewhere: free gateway endpoints for S3 and DynamoDB, ECR pulls kept off NAT, public IPv4 addresses at $3.65 a month each, and IPv6 egress that has no hourly charge.

NAT Gateway
VPC
IPv4
VPC Endpoints
Cost Optimization

NAT gateways are one of the first lines people find when they read a bill closely. In US East a NAT gateway costs $0.045 per hour and $0.045 per GB processed. One per Availability Zone across three AZs is about $99 a month before a single byte moves, and every gigabyte through it costs as much again as the hour.

Regional NAT gateways: simpler, not cheaper

Since November 2025 a NAT gateway can be regional. One gateway spans the AZs where your workloads run, expands to new AZs automatically and needs no public subnet. Route tables point at one gateway instead of one per AZ.

It is billed per AZ it runs in: three AZs for an hour is three NAT gateway-hours, the same as three zonal gateways. Data processing is the same $0.045/GB. Choose it for operations, not for cost. Three details worth knowing:

  • Expansion to a new AZ takes 15–20 minutes on average and up to 60. Until then, traffic from that AZ is routed through another AZ, which adds cross-AZ data transfer.

  • Private NAT (for routing between private networks) is not supported. Keep zonal gateways for that.

  • Each AZ scales to 100 Gbps and 32 IP addresses, and a VPC can have five regional NAT gateways.

Want a second opinion on this for your system?

Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.

Where the NAT bill actually goes

In most accounts we review, a large share of NAT data processing is traffic to AWS itself: S3, ECR image pulls, DynamoDB, CloudWatch Logs, Secrets Manager. None of it needs to go through NAT.

Traffic

Fix

Cost of the fix

S3 and DynamoDB

Gateway VPC endpoints

Free: no hourly or per-GB charge

ECR image pulls

ECR interface endpoints plus the S3 gateway endpoint (image layers are served from S3)

$0.01 per AZ-hour per interface endpoint, plus $0.01/GB

CloudWatch Logs, STS, Secrets Manager, SQS

Interface endpoints for the heavy ones

$0.01 per AZ-hour each, plus $0.01/GB

Third-party APIs that support IPv6

Dual-stack subnets and an egress-only internet gateway

No hourly charge; standard data transfer only

Cross-AZ hops to a NAT in another AZ

A NAT per AZ, or a regional NAT that has finished expanding

Saves $0.01/GB each way

Interface endpoints are not free. Each costs about $7.30 a month per AZ. Add them only where traffic justifies it: at $0.045 vs $0.01 per GB, an interface endpoint in three AZs pays for itself at roughly 630 GB a month. The S3 gateway endpoint is the one to add everywhere, today.

Public IPv4 addresses

Every public IPv4 address costs $0.005 per hour, in use or idle: $3.65 a month each. Load balancers use several, as do NAT gateways, EC2 instances with auto-assigned public IPs and forgotten Elastic IPs. Amazon VPC IP Address Manager has a free tier that reports public IP usage across the account. The usual findings are idle Elastic IPs, instances in public subnets that only needed outbound access, and test load balancers nobody deleted.

The order we work in

  1. Add the S3 and DynamoDB gateway endpoints to every VPC. Free, and usually the largest single saving.

  2. Split NAT data processing by destination using VPC Flow Logs, so you know what is behind the number.

  3. Add interface endpoints only for destinations above the break-even.

  4. Delete idle Elastic IPs and stop auto-assigning public IPs in subnets that do not need them.

  5. Move development VPCs to a single NAT, or to regional NAT in one AZ, if an AZ outage in dev is acceptable.

hoolco Monthly Review

Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.

As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.