The Most Expensive Middleman in the Cloud
In a standard secure AWS VPC (Virtual Private Cloud — your isolated network environment), servers in private subnets cannot directly reach the internet or other AWS services. They route outbound traffic through a NAT Gateway (Network Address Translation Gateway), which acts as a proxy, translating private IP addresses to a public IP for outbound connections.
The NAT Gateway is one of the most notorious cost drivers in AWS because it charges you on two dimensions simultaneously:
- Hourly Fee: ~$0.045/hour per gateway, which works out to roughly $32/month just for the gateway to exist — even if no traffic flows through it.
- Data Processing Fee: $0.045/GB for every byte that passes through it, in either direction.
Consider this scenario: Your application in a private subnet needs to download 100 TB of data from Amazon S3 (AWS's object storage service) to process it — a common pattern for data pipelines and ML training jobs.
If this traffic routes through the NAT Gateway:
100,000 GB × $0.045/GB = $4,500
This is $4,500 to move data between two services that are both inside AWS's own network. You are paying AWS to carry data from one AWS service to another AWS service, through an AWS middleman, on AWS infrastructure. This is an architectural failure, not a pricing quirk.
The trap is subtle: S3 traffic looks like internet traffic to a private subnet because S3 has public IP addresses. Without explicit configuration, your VPC has no way to know that s3.amazonaws.com is actually reachable internally. The NAT Gateway dutifully forwards the traffic out to the public internet endpoint of S3 and charges you for every byte.