Functions in a VPC: what network attachment really costs

Quick answer

Attaching a Lambda to a VPC costs nothing directly, and the Hyperplane ENIs it uses are not billed. The cost comes from outbound internet access: a NAT gateway costs $0.045 per hour, about $32.85 a month per AZ, plus $0.045 per GB processed. Two AZs for availability is $65.70 a month before a single byte moves. Interface VPC endpoints cost $0.01 per AZ-hour, about $7.30 a month each, plus $0.01 per GB, and S3 and DynamoDB gateway endpoints are free. For a function that only talks to AWS services, replacing NAT with endpoints usually cuts VPC networking cost by 70 to 90 percent.

Putting a function inside a VPC is one of those decisions that appears to be purely architectural and turns out to be mostly financial. The attachment itself is free. What it changes is how the function reaches anything outside the subnet, and every option for that has a price with a fixed hourly component that does not care how much traffic you send.

What is and is not charged

Item	Cost
VPC itself, subnets, route tables, security groups	$0
Hyperplane ENIs used by Lambda	$0
NAT gateway	$0.045 per hour + $0.045 per GB
Interface VPC endpoint	$0.01 per AZ-hour + $0.01 per GB
Gateway endpoint (S3, DynamoDB)	$0
Cross-AZ traffic	$0.01 per GB each direction
Internet egress	From $0.09 per GB

The ENI point is worth stating clearly because it used to be different. Lambda's VPC networking uses shared Hyperplane ENIs created per unique subnet and security group combination, they are not billed, and they no longer add the multi-second cold start penalty that made VPC attachment notorious. The modern cost of a VPC function is almost entirely about the route to the outside.

The NAT gateway floor

A function in a private subnet that needs to reach the public internet, or any AWS service without a VPC endpoint, needs a NAT gateway. One costs $0.045 per hour, which is $32.85 a month at 730 hours, plus $0.045 per GB processed. For high availability you deploy one per AZ, so a two-AZ setup is $65.70 a month and a three-AZ setup is $98.55, before traffic.

Setup	Fixed monthly	At 500 GB processed	At 5 TB processed
1 NAT gateway	$32.85	$55.35	$257.85
2 NAT gateways	$65.70	$88.20	$290.70
3 NAT gateways	$98.55	$121.05	$323.55

For a function that costs $5 a month to run, a two-AZ NAT setup is thirteen times its compute bill. That is the single most common shape of a surprising serverless network charge.

Endpoints instead of NAT

Most VPC-attached functions only talk to AWS services: DynamoDB, S3, Secrets Manager, KMS, SQS, and so on. Every one of those has a VPC endpoint, and routing through endpoints avoids the NAT gateway entirely.

Gateway endpoints for S3 and DynamoDB are free, with no hourly charge and no per-GB charge. Interface endpoints for everything else cost $0.01 per AZ-hour, roughly $7.30 a month per AZ, plus $0.01 per GB. A function needing Secrets Manager, KMS, and SQS across two AZs pays 3 endpoints times 2 AZs times $7.30, which is $43.80 a month, against $65.70 for the NAT gateways plus four and a half times the per-GB rate.

Function needs	Cheapest option	Monthly (2 AZ)
S3 and DynamoDB only	Gateway endpoints	$0
S3, DynamoDB, Secrets Manager	Gateway + 1 interface	$14.60
Five AWS services	Interface endpoints	$43.80 to $73.00
Arbitrary internet access	NAT gateway	$65.70 plus $0.045 per GB
Mixed, mostly AWS	Endpoints plus one shared NAT	Varies, usually lowest

Once you need more than about eight interface endpoints per AZ, a NAT gateway becomes competitive on the fixed side, though its $0.045 per GB against the endpoint's $0.01 per GB keeps endpoints ahead for data-heavy paths.

Cross-AZ traffic is the quiet line

A VPC-attached function placed in multiple subnets is assigned an AZ per execution environment, and it does not necessarily land in the same AZ as the resource it talks to. Traffic between AZs costs $0.01 per GB in each direction, so a chatty function reading 2 TB a month from a database in another AZ pays about $40 in transfer that would be free within a single AZ. The same applies to a NAT gateway in a different AZ from the function using it, which adds the cross-AZ charge on top of the $0.045 per GB processing fee. Keeping functions, NAT gateways, and data in aligned AZs is free to arrange and removes the charge entirely, which is why per-AZ NAT gateways are about cost as much as availability.

The question worth asking first

Does the function need to be in the VPC at all? A function is only required to be VPC-attached when it must reach a private resource: an RDS instance without public access, an ElastiCache cluster, a private API, or an on-premises system over a VPN or Direct Connect. If it only calls public AWS APIs, leaving it outside the VPC costs nothing, reaches everything, and avoids the entire discussion.

A large fraction of VPC-attached functions are there because a template put them there or because a policy says everything goes in a VPC. Those policies are often reasonable for instances and containers and accidental for functions. Where the policy stands, share NAT gateways across accounts using a central egress VPC with Transit Gateway, which replaces per-account NAT with one shared set, keeping in mind that Transit Gateway costs $0.05 per attachment-hour plus $0.02 per GB. Compare the options against theendpoint and NAT comparison and price the network path against the resource catalog before the subnet configuration ships.

FAQ

Does putting a Lambda in a VPC cost extra?

The attachment itself is free, and the Hyperplane ENIs Lambda uses for VPC networking are not billed. The cost comes from how the function reaches anything outside its subnet: a NAT gateway for internet access at $0.045 per hour plus $0.045 per GB, or VPC endpoints at $0.01 per AZ-hour plus $0.01 per GB for interface types.

How much does a NAT gateway cost for a serverless workload?

One NAT gateway is $0.045 per hour, about $32.85 a month at 730 hours, plus $0.045 per GB processed. A two-AZ highly available setup is $65.70 a month before traffic and a three-AZ setup is $98.55. For a function costing $5 a month in compute, that network floor is over thirteen times the compute bill.

Are VPC endpoints cheaper than a NAT gateway?

Usually. Gateway endpoints for S3 and DynamoDB are completely free. Interface endpoints cost $0.01 per AZ-hour, roughly $7.30 a month per AZ, plus $0.01 per GB, which is a fifth of the NAT per-GB rate. NAT only becomes competitive on fixed cost past roughly eight interface endpoints per AZ, and stays worse per GB.

Do Lambda VPC ENIs still cause slow cold starts?

No. Lambda's VPC networking uses shared Hyperplane ENIs created per unique subnet and security group combination, which removed the multi-second cold start penalty that VPC attachment used to carry. The ENIs are not billed either, so the modern cost of a VPC-attached function is almost entirely about the outbound route it requires.

When does a Lambda function actually need to be in a VPC?

Only when it must reach a private resource: an RDS instance without public access, an ElastiCache cluster, a private API endpoint, or an on-premises system over VPN or Direct Connect. A function calling only public AWS APIs works fine outside a VPC, costs nothing extra in networking, and avoids the NAT gateway question entirely.

How does C3X help with VPC networking cost?

C3X prices NAT gateways, VPC endpoints, and the functions attached to them from Terraform, so the network floor under a serverless design appears in the pull request. That is where a two-AZ NAT gateway added by a module default, costing $65.70 a month beside a $5 function, is cheapest to reconsider.

What to do next

See the network floor under your functions. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.