A NAT gateway costs $36.50 a month per AZ before it moves a byte, then $0.045 for every gigabyte, including traffic to S3 and ECR that has a free path. fck-nat is an open-source NAT instance that runs on a t4g.nano for about $3 a month with no per-gigabyte charge. What it costs, what you give up, and how to run it safely.
Most teams meet the NAT gateway on their bill, not in their design. Private subnets need a way out to the internet, the VPC wizard adds a NAT gateway per Availability Zone, and nobody looks again until EC2-Other is one of the largest lines on the invoice.
It charges by the hour whether you use it or not: $0.045 an hour, plus $0.005 an hour for its public IPv4 address. That is $36.50 a month per gateway, and the default layout has one per AZ.
It charges again for every gigabyte it processes: $0.045/GB, on top of whatever the data transfer itself costs.
It processes traffic that never needed it. Container image pulls from ECR, reads from S3, logs to CloudWatch and calls to STS all go through NAT unless you add endpoints.
It hides in EC2-Other. In Cost Explorer, group by usage type and look for NatGateway-Hours and NatGateway-Bytes.
Internet data transfer out is charged the same either way, so it is left out of both rows. The saving is the gateway hours and the $0.045 per gigabyte.
fck-nat is an MIT-licensed project that publishes ready-made NAT instance AMIs on Amazon Linux 2023, for ARM and x86. It replaces the do-it-yourself NAT instance that AWS documented years ago and whose AMI hasn't been updated since 2018. It is a regular EC2 instance with source/destination checking turned off, and your private route tables point at it instead of a NAT gateway.
Its high-availability mode runs each instance in an Auto Scaling group of one, with a fixed network interface that the replacement instance attaches when it boots. The route tables point at the interface, so they never change. The project is honest that this is "not completely immune to outages": while a replacement boots, that AZ has no outbound internet.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
The fck-nat docs make the point clearly: a t4g.nano bursts to 5 Gbps but sustains only 32 Mbps. Fine for API calls, webhooks and occasional downloads; not for a service that streams data out all day. Their sizing table:
Even the 1.6 Gbps option costs less per month than one NAT gateway sitting idle, and none of them charge per gigabyte.
Add the S3 and DynamoDB gateway endpoints. They are free, and they take that traffic off NAT entirely.
Add interface endpoints only where the volume pays for them: each costs about $7.30 a month per AZ and $0.01/GB, so it pays off at roughly 209 GB a month per AZ. Our NAT cost calculator does this sum.
Find who is using NAT with VPC Flow Logs queried in Athena before deciding anything else.
Consider IPv6 for outbound traffic: an egress-only internet gateway has no hourly or per-gigabyte charge, where the destination supports IPv6.
Sustained outbound traffic in the gigabits, where you would be sizing large instances anyway and want AWS to own it.
Compliance or a customer contract that asks for managed components only.
No one on the team who will patch an instance, watch an alarm and test failover twice a year.
Deploy it as code: the cdk-fck-nat construct is the best-supported route, with an official Terraform module as well. Both set up HA mode and routing.
One instance per AZ, so an AZ's traffic doesn't cross zones (and pay $0.01/GB each way) to reach it.
Alarms on instance health and on network throughput approaching the instance's baseline.
A patch routine: roll the Auto Scaling group onto the newest fck-nat AMI on a schedule.
A written rollback: switching route tables back to a NAT gateway takes minutes if it is rehearsed.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Where AWS Charges for Data Transfer: A Map of Every Hop, with 2026 Prices
Data transfer is the AWS cost people understand least, because it is spread across a dozen line items. Every hop a byte can take (same AZ, cross-AZ, cross-Region, internet, NAT, Transit Gateway, PrivateLink, CloudFront) with US East prices and the architecture patterns that quietly multiply them.
Read
NAT Gateway Costs in 2026: Regional NAT, Public IPv4 Charges and the Endpoints That Cut the Bill
AWS's regional NAT gateway simplifies multi-AZ networking but costs the same per hour. The savings are elsewhere: free gateway endpoints for S3 and DynamoDB, ECR pulls kept off NAT, public IPv4 addresses at $3.65 a month each, and IPv6 egress that has no hourly charge.
Read
As of November 2, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.