AWS NAT gateway cost calculator: what gateway and interface endpoints would save

How it is calculated

C_NAT = n × h × r_hr + G × r_gb

C_GW = n × h × r_hr + G × (1 − s − d) × r_gb      (the endpoints themselves are free)

C_IE = n × h × r_hr + G × (1 − s − d − e) × r_gb + k × n_az × h × r_ie_hr + P(G × e)

G* = k × n_az × h × r_ie_hr ÷ (r_gb − r_ie_gb)
interface endpoints save money when G × e > G*

C_single = 1 × h × r_hr + G × r_gb      (information only: no AZ redundancy)

Assumptions

• n is the number of NAT gateways (the AZ count for one per AZ, otherwise 1), h the hours they run, G the GB they process, and s, d and e the S3, DynamoDB and interface-eligible shares as fractions. r_hr and r_gb are the NAT gateway hourly and per-GB rates; r_ie_hr and r_ie_gb are the interface endpoint rates.
• k is the number of interface endpoints you would create and n_az the AZ count: each endpoint is billed in every AZ, every hour. P(x) prices x GB across the interface endpoint's volume bands (cheaper above 1 PB a month); at ordinary volumes P(x) = x × r_ie_gb.
• Gateway endpoints cost nothing per hour or per GB, so moving S3 and DynamoDB traffic off the NAT gateway removes its per-GB charge. They are free to add on top of any layout.
• If you create no interface endpoints (k = 0), the interface-eligible traffic stays on the NAT gateway.
• Internet data transfer out of the NAT gateway, cross-AZ data transfer, public IPv4 address charges and CloudWatch are billed separately and are not in any total.
• The single NAT gateway scenario is information only; it is never picked as the best scenario because it removes AZ redundancy.
• Prices are list prices in USD. Regional NAT gateways bill $0.045 per AZ-hour in US East (Ohio), the same as one zonal gateway per AZ, so the one-per-AZ layout models them there. Savings plans, private pricing and free tiers are not applied.

The data behind it

Three ways to reduce this number

1. Add S3 and DynamoDB gateway endpoints to every route table that uses a NAT gateway.
2. Move high-volume AWS API traffic (ECR image pulls, CloudWatch Logs) to interface endpoints, but only when the eligible traffic is above the break-even shown here.
3. Keep chatty jobs in subnets whose route table points at the NAT gateway in their own AZ.

Use it from code

The same engine is available as a REST endpoint and as an MCP tool named calc_aws_nat_gateway_privatelink_estimator. Your scenario as an API call:

curl -X POST 'https://api.x12i.com/v1/calc/aws-nat-gateway-privatelink-estimator' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "input": {
    "region": "us-east-1",
    "az_count": 3,
    "nat_topology": "per_az",
    "gb_processed_per_month": 10000,
    "active_hours_per_month": 730,
    "s3_share_pct": 0,
    "dynamodb_share_pct": 0,
    "interface_eligible_share_pct": 0,
    "interface_endpoint_count": 3,
    "workload_platform": "ec2"
  },
  "options": {
    "explain": false
  }
}'

Copy as API call Schema: GET /v1/calc/aws-nat-gateway-privatelink-estimator/schema

Frequently asked questions

Related calculators