Practical guide
NAT Gateway vs VPC endpoints: calculate the traffic break-even
compare NAT Gateway and VPC endpoint costs. Includes a worked example, calculator scope, and practical questions.
Updated · Sources checked
Compare the traffic path, not just a per-GB price
Moving eligible service traffic away from a NAT gateway can reduce NAT processing charges. The size of the saving depends on which traffic actually changes route and whether the NAT gateway remains necessary for other destinations. Interface endpoints can add their own hourly and data-processing charges; gateway endpoints have a different billing model.
For supported S3 and DynamoDB traffic, AWS documents gateway endpoints without an additional endpoint charge. Check route tables and service eligibility before treating a database or object-storage request as bypassing NAT.
Worked example: traffic diversion without removing NAT
Suppose a workload processes 2,000 GB through NAT each month. Investigation shows 1,400 GB is eligible service traffic that can use the selected endpoint, while 600 GB still needs NAT.
If the gateway count and running hours stay unchanged, the NAT processing reduction is 1,400 × P, where P is the relevant NAT processing rate. Gateway-hour savings are zero in this scenario. Run the calculator twice with identical gateway and hour inputs, first with 2,000 GB and then with 600 GB.
For an interface endpoint alternative, compare that avoided processing cost with the endpoint’s full hourly, processing, and applicable transfer cost. If its additional fixed monthly expense is F and the net per-GB saving is D, the simplified break-even is F ÷ D GB, provided D is positive. Use current service-specific endpoint rates rather than the NAT rate in that calculation.
Check operational fit
Inventory every destination before changing routes. Third-party APIs, package repositories, and external identity services may still require outbound connectivity. Also check DNS behavior, endpoint policies, Availability Zone placement, and cross-zone paths with an application test.
The NAT calculator estimates the NAT side only. It does not select endpoint types or include their charges. Retain a separate endpoint worksheet so the final decision compares complete alternatives and keeps availability requirements visible.
Frequently asked questions
Can I claim gateway-hour savings immediately after adding an endpoint? Only if billable gateway provisioning actually decreases; diverted traffic alone does not do that.
Is an interface endpoint always cheaper? No. Low traffic can leave its fixed charges larger than the NAT processing it avoids.
Calculate your scenario
Use the nat gateway cost calculator. Keep the displayed region, pricing date, billing units, and exclusions alongside your result. The arithmetic examples above illustrate usage or explicitly hypothetical rates; they are not AWS quotes.
Source
Billing structure checked against official AWS documentation on September 6, 2026.