Explain AWS NAT Gateway cost increases
On this page
This check is due for a source refresh. Confirm the current documentation before you rely on provider-specific details.
Separate gateway-hours, processed GB, and transfer charges before changing network paths. Otherwise you may reduce traffic while still paying for provisioned NAT Gateway-hours, or misattribute transfer costs to NAT processing.
What you need first
- Tool
- The AWS CLI, or Command Line Interface, sends AWS requests from a terminal. This procedure uses Cost Explorer's GetCostAndUsage operation to retrieve account cost and usage metrics for a chosen time window.
- Access
- If you lack approved billing access, ask an authorized AWS billing colleague to provide the read-only GetCostAndUsage result for the intended account or organization scope.
- If you do not use that tool
- Give the colleague the account scope, higher-cost period, and equal-length baseline. Request daily UnblendedCost and UsageQuantity grouped by USAGE_TYPE and AZ, with NAT Gateway and transfer-related rows identified separately.
Why this is worth a look
Skipping this check can send the investigation toward the wrong network change. AWS bills a NAT Gateway-hour while the gateway is provisioned and available, charges each gigabyte processed, and also applies standard data-transfer charges. Partial gateway-hours are billed as full hours. For regional NAT gateways, hourly billing applies in each configured Availability Zone, so compare zone coverage when hours rise.
Run these commands
BASHRun this read-only AWS CLI command after replacing the example dates. It returns daily UnblendedCost and UsageQuantity grouped by usage type and Availability Zone, including rows beyond NAT Gateway because no service filter is set.
set -euo pipefail
aws ce get-cost-and-usage \
--time-period Start=2026-08-01,End=2026-09-01 \
--granularity DAILY \
--metrics UnblendedCost UsageQuantity \
--group-by Type=DIMENSION,Key=USAGE_TYPE Type=DIMENSION,Key=AZHow to confirm it
- 01
Choose comparable periods
Set Start and End for the higher-cost period, then repeat for an equal-length baseline. Start is inclusive and End is exclusive. Confirm the intended account or organization scope before comparing results.
- 02
Separate the cost drivers
Run the command, or request its output from your billing colleague. Identify NAT Gateway-hour, processed-data, and transfer-related usage types. The command has no service or account filter, so do not treat every returned row as NAT Gateway spend.
- 03
Compare units by dimension
Compare daily UnblendedCost and UsageQuantity within each usage type and Availability Zone. Keep hours and GB separate. If gateway-hours rose, check provisioned time and regional zone coverage. If processed GB rose, ask the network owner to investigate traffic.
- 04
Validate traffic signals
Review existing VPC Flow Logs to determine traffic direction to and from network interfaces during the affected period. In the CloudWatch console, choose Metrics, All metrics, NATGateway, then a metric dimension. Use these observations to guide investigation, not to prove that one workload caused a billing row.
Before making changes
Assume Cost Explorer is available and the configured account covers the intended period. An AWS Organizations management account can retrieve member-account costs, so this unfiltered command may cover multiple accounts. Transfer rows are not automatically attributable to NAT traffic. Review existing VPC Flow Logs before publishing new logs because ingestion and archival charges apply. Cost and Usage Report updates within the month are estimates; AWS finalizes usage charges after issuing the invoice.