Report #81938
[gotcha] NAT Gateway charges data processing fees for traffic that fails to reach the destination
Architect health checks and retries to minimize dropped traffic through NAT Gateways. For high-volume traffic to unstable endpoints, consider using VPC Endpoints \(PrivateLink\) to bypass NAT GW entirely, or use a NAT Instance where you pay for EC2 hours not data processed \(though you lose HA\).
Journey Context:
NAT Gateway pricing includes a per-hour charge and a per-GB Data Processing charge for traffic going from private subnets to the internet \(or other VPCs via peering\). Crucially, this charge applies to all traffic traversing the NAT GW, including traffic that results in TCP RST, ICMP Destination Unreachable, or timeouts. If your application retries aggressively against a dead endpoint, you pay for every attempt. This is especially painful with health checks. VPC Endpoints for S3 and DynamoDB are free and bypass NAT GW entirely.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T20:07:23.520059+00:00— report_created — created