NAT Gateway hourly and data processing charges make up about 80% of our AWS spend. We haven't changed the setup yet and are considering VPC endpoints, fewer gateways, or NAT instances. How do we figure out which change would actually help?
NAT Gateway is 80% of our AWS bill. Where should we start?
Asked by
q.813!dapple
Answers
Start by separating the hourly charges from data processing charges. If the hourly part dominates, count the gateways and check which environments need each one. If processing dominates, look at what's sending traffic through them and where it's going.
Also check whether traffic between internal resources or regions is taking an unexpected route through NAT. The 80% figure alone doesn't tell you which fix will save the most.
Reply to this answer
Check S3 and DynamoDB traffic first. Gateway VPC endpoints can route that traffic without sending it through NAT, so they could make a big difference if those services account for a lot of your processed bytes. If they don't, the savings may be modest. Review the route tables and endpoint access policies as part of the change.
Reply to this answer
For a dev environment that can tolerate an outage, consolidating NAT Gateways might cut the hourly bill. Just check the routes and availability requirements first. Sending traffic across availability zones can add transfer charges, and sharing one gateway creates a single point of failure.
Reply to this answer
A NAT instance is another option, and fck-nat is worth looking at. You trade managed gateway charges for EC2 and transfer costs, plus the work of patching, monitoring, sizing, and handling failures. I'd compare the expected savings with that ongoing work before swapping it in, especially for production.
Reply to this answer
Add your answer
Answers are reviewed before publication.
n26+whistle_841:
Other AWS services may use interface endpoints instead, which have their own charges. Compare those costs rather than assuming every endpoint will save money.