VPC endpoint vs NAT gateway cost: when the endpoint is free money

Quick answer

For S3 and DynamoDB, add a gateway endpoint, it is free and takes that traffic off your NAT gateway, cutting NAT data-processing charges. For other AWS services, an interface endpoint costs about $0.01 per hour per AZ plus $0.01 per GB, which beats NAT (about $0.045 per hour plus $0.045 per GB) once the traffic volume is high enough to cover the hourly fee.

NAT gateway is the quiet budget-eater of most VPCs, and a large share of its data-processing charge is traffic to AWS services that never needed to leave the AWS network. VPC endpoints route that traffic privately, and for two services they do it for free.

Gateway endpoints: free, use them always

S3 and DynamoDB support gateway endpoints, which cost nothing, no hourly fee, no per-gigabyte charge. Any traffic from private subnets to S3 or DynamoDB that currently flows through a NAT gateway is being charged NAT data processing for no reason. Adding a gateway endpoint removes that traffic from NAT entirely. This is the closest thing to free money in AWS networking, and every VPC with private subnets should have both.

NAT gateway: the baseline you are trying to shrink

Resource	Hourly	Per GB
NAT gateway	~$0.045 / hour	~$0.045 / GB processed
Interface endpoint	~$0.01 / hour per AZ	~$0.01 / GB processed
Gateway endpoint (S3, DynamoDB)	Free	Free

See NAT gateway cost and alternatives for the full picture on shrinking NAT itself.

Interface endpoints: cheaper than NAT above a threshold

Interface endpoints (PrivateLink) exist for most AWS services and cost roughly $0.01 per hour per Availability Zone plus $0.01 per gigabyte. You pay the hourly fee per AZ whether or not traffic flows, so an endpoint is only cheaper than NAT once the traffic it removes covers that fixed cost. For a high-volume path to a service like ECR, CloudWatch, or SSM, the per-gigabyte saving (one cent versus four and a half) pays back the hourly fee quickly. For a trickle of traffic across many services, the per-AZ hourly fees can add up faster than the NAT charge you avoid.

How to decide

Always add gateway endpoints for S3 and DynamoDB. For everything else, add an interface endpoint when a service carries enough traffic that one cent per gigabyte beats four and a half, and the endpoint hours are justified by the volume. Endpoints also improve security by keeping traffic off the public internet, so the decision is often not cost alone. Model both before you build so you are not paying NAT data processing for traffic that could be free.

FAQ

Are VPC gateway endpoints free?

Yes. Gateway endpoints, which exist for S3 and DynamoDB, have no hourly fee and no per-gigabyte charge. They route that traffic privately and remove it from your NAT gateway, cutting NAT data-processing cost. Every VPC with private subnets should have both.

How much does an interface endpoint cost?

About $0.01 per hour per Availability Zone plus about $0.01 per gigabyte processed. The hourly fee is charged per AZ whether or not traffic flows, so an interface endpoint saves money only once its traffic volume justifies that fixed cost.

When is a VPC endpoint cheaper than a NAT gateway?

Gateway endpoints for S3 and DynamoDB are always cheaper because they are free. Interface endpoints beat NAT when a service carries enough traffic that $0.01 per GB (versus roughly $0.045 for NAT) covers the per-AZ hourly fee. High-volume paths pay back quickly; low-volume ones may not.

Do VPC endpoints reduce my NAT gateway bill?

Yes. Any AWS-service traffic you move to an endpoint no longer flows through the NAT gateway, so you avoid the NAT per-gigabyte data-processing charge on that traffic. Gateway endpoints for S3 and DynamoDB are the highest-impact change.

Should I add an interface endpoint for every service?

No. Each interface endpoint has a per-AZ hourly fee, so many low-traffic endpoints can cost more than the NAT charge they avoid. Add interface endpoints for high-volume paths and for services where keeping traffic off the public internet matters for security.

Does C3X estimate VPC endpoint and NAT cost?

C3X prices aws_vpc_endpoint and aws_nat_gateway from your Terraform, so the fixed hourly components appear before deploy. The per-gigabyte comparison depends on traffic volume, which you provide as a usage assumption.

What to do next

Compare endpoint and NAT topology before you build it. C3X prices your VPC networking and the rest of your stack from Terraform against a live catalog. Start with the quickstart.