EKS NAT Gateway Cost: Why It Is High and How to Cut It

An AWS NAT gateway in us-east-1 costs $0.045 per hour plus $0.045 for every gigabyte it processes, and that per-GB charge applies on top of any data transfer charges. EKS clusters pay it because nodes in private subnets send image pulls, S3 traffic, AWS API calls and telemetry through the NAT gateway by default, even when the destination is another AWS service in the same region.

The fix is rarely to remove the NAT gateway. It is to take the large, predictable flows off it: S3 and DynamoDB through free gateway endpoints, high-volume AWS APIs through interface endpoints, and every remaining flow through a NAT gateway in the same Availability Zone. AWS prices below are for us-east-1, and all prices are as of October 2026.

How much does an AWS NAT gateway cost?

A NAT gateway has two charges: $0.045 for each hour it is provisioned and $0.045 for each gigabyte it processes in us-east-1. AWS states that the processing charge applies "regardless of the traffic's source or destination," so downloads into the cluster are billed the same as uploads.

Sources: Amazon VPC pricing, the AWS Price List API offer files for AmazonEC2 and AWSDataTransfer, and EC2 on-demand data transfer pricing. In us-east-1 the NAT usage types have no region prefix. In other regions they do, for example USE2-NatGateway-Bytes in us-east-2.

A gateway that sits idle still costs $0.045 × 730 hours, or about $32.85 a month. Three gateways, one per zone, cost about $98.55 a month before any traffic.

Why is my EKS NAT gateway bill so high?

Most EKS clusters put nodes in private subnets with a default route to a NAT gateway, so every byte bound for anything outside the VPC is processed by it. The large flows are usually AWS services in the same region, not the internet.

Common sources of NAT traffic in an EKS cluster:

• Container image pulls. Amazon ECR serves the manifest from the ECR API and the layers from Amazon S3, per the ECR endpoint docs. Images from Docker Hub, Quay or GitHub Container Registry come from the internet. Node scale-ups, new deployments and evicted pods all pull again.
• Amazon S3. Application data, backups, log and metrics backends that store objects in S3, and data pipelines.
• AWS APIs. STS calls for IAM roles for service accounts, EC2 and Elastic Load Balancing calls from controllers, and CloudWatch Logs from log agents.
• Telemetry export. Logs, metrics and traces shipped to a SaaS observability vendor.
• External APIs and package downloads. Payment providers, LLM APIs, OS package mirrors and language package registries.

Because inbound internet data transfer is free on AWS, a 1 GB image layer pulled from Docker Hub costs only the $0.045 NAT processing charge. The same gigabyte pulled from ECR through the NAT gateway also costs $0.045, even though it never leaves AWS.

What does a typical EKS NAT gateway bill look like?

A mid-sized cluster with one NAT gateway per zone and 20 TB a month through them pays about $1,350 a month, and nearly half of that goes away with one free gateway endpoint. The example below uses us-east-1 prices and 1 TB = 1,000 GB for readability.

Assumed monthly NAT traffic for a three-zone EKS cluster:

Add $98.55 for three gateway-hours charges and the total is about $1,349.55 a month. The internet egress line is (4,000 − 100 free GB) × $0.09.

After an S3 gateway endpoint and a CloudWatch Logs interface endpoint in each zone:

The SaaS telemetry line is the one left. The internet egress guide covers how to shrink it.

How do I find NAT gateway charges in the AWS Cost and Usage Report?

Filter on usage types that contain NatGateway. In CUR 2.0, the line_item_usage_type column holds values such as NatGateway-Bytes and NatGateway-Hours, and line_item_resource_id holds the NAT gateway ID when resource IDs are included in the export.

1SELECT
2  line_item_resource_id                AS nat_gateway,
3  line_item_usage_type                 AS usage_type,
4  SUM(line_item_usage_amount)          AS usage_amount,
5  ROUND(SUM(line_item_unblended_cost), 2) AS cost_usd
6FROM cur2
7WHERE line_item_usage_type LIKE '%NatGateway-%'
8  AND line_item_usage_start_date >= DATE '2026-09-01'
9  AND line_item_usage_start_date <  DATE '2026-10-01'
10GROUP BY 1, 2
11ORDER BY cost_usd DESC;

For -Bytes rows, usage_amount is gigabytes processed. Add rows where line_item_usage_type ends in DataTransfer-Regional-Bytes to see cross-zone charges, which include traffic from nodes to a NAT gateway in another zone.

The CUR shows which gateway is expensive, not which pod sent the bytes. To find the workload, enable VPC Flow Logs on the NAT gateway's network interface and group by source address, or measure per pod as described in how to measure traffic per workload.

How do I stop paying NAT charges for S3 and DynamoDB?

Create gateway VPC endpoints for S3 and DynamoDB. AWS states that "there is no additional charge for using gateway endpoints," and once the endpoint is associated with your private route tables, traffic to the service in that region bypasses the NAT gateway.

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc1234 \
  --vpc-endpoint-type Gateway \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-0private1a rtb-0private1b rtb-0private1c

Three details matter:

• ECR layers ride on this endpoint. ECR stores layers in an S3 bucket named prod-<region>-starport-layer-bucket. If you attach a restrictive endpoint policy, allow s3:GetObject on that bucket or image pulls will fail.
• Every private route table needs the association. Subnets whose route tables are not associated keep using the NAT gateway.
• Only same-region traffic is covered. Requests to an S3 bucket in another region still go through the NAT gateway, because the prefix list is regional.

Existing connections

AWS notes that containers with open connections to S3 may see them interrupted briefly when the S3 gateway endpoint is added. Plan the change for a quiet window.

Which interface endpoints are worth it for EKS?

An interface endpoint costs $0.01 per hour in each Availability Zone plus $0.01 per GB processed (first 1 PB a month), so it pays for itself once it carries about 209 GB a month per zone. That threshold comes from the $7.30 monthly hourly charge divided by the $0.035 per GB you save versus NAT processing.

The endpoint list comes from the EKS private cluster guide. Enable private DNS on each endpoint so SDKs keep using the normal service hostnames. Create the endpoint in every zone that has nodes, so traffic to it does not cross zones.

Should I run one NAT gateway per Availability Zone?

Yes, for most production clusters. Traffic between a node and a NAT gateway in another zone adds cross-zone data transfer ($0.01 per GB in each direction) on top of the $0.045 processing charge, and AWS's own guidance is to "create a NAT gateway in each Availability Zone with resources."

Each private subnet's route table should point 0.0.0.0/0 at the NAT gateway in its own zone. A single shared gateway is cheaper only when traffic is very low. An extra gateway costs $32.85 a month, so it pays off once it removes about 1.6 TB (if both directions are billed, $0.02 per GB) to 3.3 TB (one direction, $0.01 per GB) of cross-zone NAT traffic a month.

AWS also offers regional NAT gateways. One regional gateway expands to every zone that has workloads, needs no public subnet, and is billed $0.045 per hour for each zone it covers. AWS documents that expansion to a new zone can take up to 60 minutes, and until then traffic from that zone is processed in another zone.

Does an ECR pull-through cache reduce NAT costs?

Yes, when a large share of your pulls come from public registries. A pull-through cache rule copies images from an upstream registry into your private ECR registry on first pull, and later pulls come from ECR, whose layers then flow through the free S3 gateway endpoint.

ECR supports pull-through cache rules for Amazon ECR Public, the Kubernetes registry, Quay, Docker Hub, GitHub Container Registry, GitLab Container Registry, Microsoft Azure Container Registry, Chainguard and other ECR registries. For a cached tag, ECR checks the upstream for a newer version when the cached copy has not been validated in the last 24 hours. The first pull still needs a route to the internet, so keep a NAT gateway or other egress path in place. Cached images are ordinary ECR repositories, so they are billed as ECR storage.

Can IPv6 or an egress-only internet gateway avoid NAT charges?

Partly. An egress-only internet gateway has no charge of its own and lets IPv6 traffic leave the VPC without a NAT gateway, but internet data transfer charges still apply and it only carries IPv6 traffic.

It helps when your largest destinations are reachable over IPv6. Traffic to IPv4-only destinations still needs a NAT gateway, per the AWS egress-only gateway docs. Measure which destinations dominate before you plan an IPv6 migration for cost reasons.

What do GCP Cloud NAT and Azure NAT Gateway cost?

Both also charge $0.045 per gigabyte processed, with different hourly models. Google bills Cloud NAT per VM using the gateway. Azure bills a flat hourly rate per gateway.

Sources: Cloud NAT pricing, Azure NAT Gateway pricing and the Azure Retail Prices API. Azure states that its Standard and StandardV2 SKUs are priced the same. On GCP, the Cloud NAT overview states that traffic to Google APIs and services is routed through Private Google Access even when the VM uses Public NAT.

How Kubeadapt measures this

Kubeadapt's Network Intelligence uses the optional eBPF agent kubeadapt-k8s-pulse to show which workloads send traffic to external destinations and what that traffic costs. The agent runs as a privileged DaemonSet on Linux nodes with kernel 5.10 or later and is enabled with --set kubeadapt-k8s-pulse.enabled=true. Because it records DNS query names and TLS server names, you can see which pods drive traffic to S3, ECR or a SaaS endpoint before you decide which VPC endpoint to create. Kubeadapt shows cost and recommendations and never changes your workloads. See Network Intelligence and the eBPF agent docs.

Related guides

• Kubernetes cross-AZ data transfer cost
• Kubernetes internet egress cost
• Measure cross-AZ traffic per workload
• Topology-aware routing in Kubernetes
• Glossary: NAT gateway, egress