How many NAT gateways do I need? Balancing cost and availability

Quick answer

A NAT gateway costs roughly 32 to 45 dollars a month in hourly fees plus a per-GB data-processing charge, and the fully-redundant pattern runs one per availability zone, so a three-AZ VPC means three gateways and three base fees. Production workloads that need high availability should run one per AZ; dev, test, and non-critical environments can share a single gateway. The number you need is a tradeoff: one gateway is cheaper but a single point of failure, and cross-AZ routing to it also adds transfer cost. Match redundancy to how much an outage would actually cost you.

NAT gateways let resources in private subnets reach the internet for updates and outbound calls, and they are a quietly expensive piece of AWS networking. Each one carries an hourly fee (roughly 32 to 45 dollars a month depending on region) plus a per-GB charge on all traffic it processes. The question of how many you need is really a question of how much availability you are paying for.

What a NAT gateway costs

Charge	Approximate
Hourly fee (per gateway)	About 32 to 45 per month
Data processing	Per GB of traffic through the gateway
Cross-AZ transfer (if shared)	Per GB when routing across AZs

The hourly fee is the fixed cost, but on a high-traffic workload the per-GB processing charge can dwarf it, the same network-cost dynamic covered in hidden AWS costs. Every gateway you add multiplies the fixed fee, which is why the per-AZ pattern is worth thinking about rather than defaulting to.

The high-availability pattern

AWS's recommended production design places one NAT gateway in each availability zone, and routes each AZ's private subnets to the gateway in that same AZ. This gives you redundancy (an AZ failure does not take out your only gateway) and avoids cross-AZ transfer charges for NAT traffic. The cost is that a three-AZ VPC now pays three base fees, roughly triple the fixed cost of a single gateway.

When one gateway is enough

Environment	Recommendation
Production, HA-critical	One gateway per AZ
Staging	Often one shared gateway
Dev / test	One shared gateway
Ephemeral / CI	One, or a NAT instance

Non-production environments rarely justify per-AZ redundancy: a single gateway is cheaper, and if it fails during a rare AZ outage, dev traffic can wait. The tradeoff is that private subnets in other AZs route across AZ boundaries to reach the single gateway, incurring cross-AZ transfer charges, so at high volume the per-AZ pattern can actually be cheaper even before counting availability.

How to decide and cut cost

Match redundancy to the cost of an outage: production that loses money during downtime should run one gateway per AZ, while dev and test can share one. Reduce NAT spend by cutting the traffic that flows through it, route S3 and DynamoDB access through free VPC gateway endpoints instead of NAT, use interface endpoints for other AWS services, and keep chatty traffic inside the VPC. For low-traffic non-production, a self-managed NAT instance on a small box can undercut the managed gateway fee. Track NAT processing as one of the KPIs you watch, since it scales silently with traffic.

FAQ

How many NAT gateways do I need?

It depends on availability requirements. Production workloads that need high availability should run one NAT gateway per availability zone (so a three-AZ VPC uses three), which provides redundancy and avoids cross-AZ transfer. Dev, test, and non-critical environments can share a single gateway to save the extra base fees, accepting that a rare AZ failure could interrupt that traffic.

How much does a NAT gateway cost?

Roughly 32 to 45 dollars a month per gateway in hourly fees depending on region, plus a per-GB data-processing charge on all traffic that flows through it. On a high-traffic workload the per-GB processing charge can dwarf the fixed hourly fee, and running one gateway per availability zone multiplies the base cost.

Why run one NAT gateway per availability zone?

For redundancy and to avoid cross-AZ transfer charges. The recommended production pattern places a gateway in each AZ and routes that AZ's private subnets to its local gateway, so an AZ failure does not take out your only path to the internet, and NAT traffic stays within its AZ rather than incurring per-GB cross-AZ charges. The cost is paying multiple base fees.

Can I use a single NAT gateway to save money?

Yes, for non-production or non-critical environments. A single gateway saves the extra base fees, and if it fails during a rare AZ outage, dev or test traffic can wait. The tradeoff is that private subnets in other AZs route across AZ boundaries to reach it, incurring cross-AZ transfer charges, so at high traffic volume the per-AZ pattern can end up cheaper overall.

How do I reduce NAT gateway costs?

Cut the traffic flowing through it: route S3 and DynamoDB access through free VPC gateway endpoints instead of NAT, use interface endpoints for other AWS services, and keep chatty traffic inside the VPC. For low-traffic non-production, a self-managed NAT instance on a small box can undercut the managed gateway fee. Watch NAT processing as a cost KPI since it scales silently with traffic.

How does C3X help with NAT gateway cost?

C3X reads your Terraform and prices resources like NAT gateways against a live catalog before deploy, so adding a gateway per AZ shows its recurring cost in the pull request. That makes the availability-versus-cost tradeoff explicit before you ship, rather than discovering three base fees on the next invoice.

What to do next

See what each NAT gateway adds before you deploy it. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.