Stop AWS VPC NAT Gateway data processing taxes ($0.045/GB + $32.85/mo per AZ). Learn how Gateway VPC Endpoints eliminate 95% of S3 and DynamoDB data transfer bills for $0.
resource "aws_vpc_endpoint" "s3_gateway" {
vpc_id = var.vpc_id
service_name = "com.amazonaws.us-east-1.s3"
vpc_endpoint_type = "Gateway"
route_table_ids = var.private_route_table_ids
tags = {
Name = "s3-gateway-endpoint"
CostSavings = "eliminates-nat-gateway-processing-tax"
}
}The AWS Managed NAT Gateway is widely considered the most predatory baseline charge in modern cloud networking. To allow private EC2 instances, Lambda functions inside VPCs, or EKS Kubernetes pods to download software updates or call external APIs (such as OpenAI or Stripe), AWS architecture manuals instruct engineers to deploy a NAT Gateway in each public subnet.
A dual-AZ NAT Gateway deployment incurs a fixed baseline charge of $0.045 per hour per gateway (~$65.70/month) just to exist—before transmitting a single byte of data. On top of this baseline, AWS tacks on an extra $0.045 per Gigabyte data processing fee, in addition to standard internet egress charges ($0.09/GB). A team backing up 10 Terabytes of database snapshots through a NAT Gateway pays an astronomical $450 in processing fees alone.
| Architecture Pattern | Monthly Fixed Fee | Data Processing Fee | Annual Spend (5TB / Mo) | Operational Overhead |
|---|---|---|---|---|
| AWS Managed NAT Gateway | $65.70 / mo (2x AZs) | $0.045 / GB | $3,488.40 / yr | Zero (Fully managed by AWS) |
| fck-nat (ARM64 t4g.nano Instance) | $6.12 / mo (2x instances) | $0.00 / GB (Free) | $73.44 / yr (97.9% Savings) | Pre-baked open-source AMI |
| VPC Gateway Endpoints (S3 & DynamoDB) | $0.00 / mo | $0.00 / GB | $0.00 / yr | 1-click AWS Route Table change |
Over 70% of NAT processing charges in data pipelines stem from downloading container images from Amazon ECR and reading datasets from Amazon S3. AWS provides VPC Gateway Endpoints for S3 and DynamoDB 100% free of charge. Configuring a Gateway Endpoint routes internal AWS traffic directly over the AWS backbone, bypassing the NAT Gateway entirely:
# Terraform: Free S3 VPC Gateway Endpoint (Bypasses NAT Gateway)
resource "aws_vpc_endpoint" "s3" {
vpc_id = aws_vpc.main.id
service_name = "com.amazonaws.us-east-1.s3"
vpc_endpoint_type = "Gateway"
route_table_ids = [aws_route_table.private.id]
}AWS NAT Gateway is notorious as the single largest surprise line item on cloud infrastructure bills. AWS charges a flat $0.045 per hour per gateway ($32.40/month per Availability Zone), but the true financial danger is the $0.045 per GB data processing fee. When private subnets (containing ECS tasks, EKS pods, or Lambda functions) pull Docker images from Amazon ECR, stream multi-gigabyte training checkpoints from Amazon S3, or write logs to CloudWatch, traffic unnecessarily routes through the NAT Gateway, costing $45.00 per terabyte in pure transit tax.
By implementing VPC Gateway Endpoints (which are 100% free of charge for S3 and DynamoDB) and replacing managed NAT Gateways with open-source fck-nat instances running on ARM64 Graviton instances, teams routinely eliminate 80% to 95% of their monthly VPC networking invoice.
| Monthly Egress Volume | AWS Managed NAT (3 AZs) | Managed NAT + VPC Endpoints | fck-nat (t4g.nano Autoscaling) | Dual-Stack IPv6 Only |
|---|---|---|---|---|
| 500 GB / month | $119.70 | $97.20 | $9.80 | $0.00 |
| 5,000 GB (5 TB) | $322.20 | $115.20 | $12.50 | $0.00 |
| 50,000 GB (50 TB) | $2,347.20 | $310.00 | $38.40 | $0.00 |
# 1. Zero-Cost S3 Gateway Endpoint: Bypasses NAT completely for all S3 traffic
resource "aws_vpc_endpoint" "s3" {
vpc_id = aws_vpc.main.id
service_name = "com.amazonaws.us-east-1.s3"
route_table_ids = [aws_route_table.private.id]
}
# 2. Deploy open-source fck-nat on Graviton t4g.nano ($3.07/month)
module "fck_nat" {
source = "github.com/AndrewGuenther/terraform-aws-fck-nat"
vpc_id = aws_vpc.main.id
subnet_id = aws_subnet.public_a.id
instance_type = "t4g.nano"
use_cloudwatch_agent = true
update_route_tables = {
"private-a" = aws_route_table.private_a.id
}
}source_dest_check = false on the EC2 network interface; otherwise, the AWS hypervisor drops forwarded IP packets.AWS Managed NAT Gateway automatically scales up to 100 Gbps. A single t4g.nano fck-nat instance delivers up to 5 Gbps burst network bandwidth, which easily handles 99% of web applications, background workers, and CI runners. For 10Gbps+ sustained data lakes, scaling to a t4g.medium or utilizing multi-AZ fck-nat autoscaling groups provides ample bandwidth at a fraction of the cost.
IPv6 addresses are globally routable, removing the need for Network Address Translation. By attaching an AWS Egress-Only Internet Gateway (which is 100% free) to your VPC, private subnets can initiate outbound IPv6 connections directly to the internet without allowing inbound traffic, completely bypassing NAT billing.