NAT gateway dominates the AWS bill due to high throughput
NAT gateway costs per hour plus per GB. For apps pulling a lot from S3, ECR or Docker Hub, that adds up fast. VPC endpoints and gateway endpoints are the standard fix.
Try this first
- 1Run VPC Flow Logs and see which endpoints draw the most traffic. Often 60-80 percent is S3, ECR, or Secrets Manager.
- 2Add S3 and DynamoDB Gateway Endpoints to your VPC. They're free and route S3 traffic around the NAT.
- 3For other AWS services (ECR, SSM, Secrets Manager, KMS): Interface Endpoints (PrivateLink). They cost hourly per AZ plus per GB, but less than NAT.
- 4Move container images to ECR with VPC endpoint, or use a pull-through cache. Direct Docker Hub stays going via NAT.
- 5Do the math: an Interface Endpoint runs a few euros per month per AZ plus per GB. Replace 50 GB per day of NAT traffic with it and the payback is usually within a week.
When to bring us in
If you're structurally above 100 GB per day of NAT throughput, bringing in a network architect to align endpoints and routing usually pays back within a month.
See also
- Everyone logs in with the AWS root accountRoot is for emergencies and billing. Day-to-day work belongs in IAM users or SSO.
- Every developer has AdministratorAccessAdministratorAccess everywhere is convenient now, painful later. Start with role-based policies.
- Everyone has individual IAM users with their own passwordIdentity Center (formerly AWS SSO) links to your IdP and issues temporary credentials per session.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.