Resources in a VPC reach things outside it in three main ways: through an internet gateway, through a NAT gateway, or through VPC endpoints. Each has a different security posture and price, and NAT gateway data charges are one of the most common surprises on AWS bills. Here is how to choose.
At a glance
| Internet gateway | NAT gateway | Gateway endpoint | Interface endpoint | |
|---|---|---|---|---|
| Direction | Inbound and outbound | Outbound only | Private access to S3 or DynamoDB | Private access to many AWS services and PrivateLink services |
| Who uses it | Resources with public IPs | Private resources | Any resource in associated route tables | Any resource that can reach its ENIs |
| Goes over the internet | Yes | Yes | No | No |
| Cost | Free (public IPv4 addresses are billed) | Hourly + per GB processed | Free | Hourly per AZ + per GB processed |
Internet gateway
An internet gateway connects a VPC to the internet in both directions. Subnets whose route table sends 0.0.0.0/0 to it are public. Resources there need a public IPv4 address or Elastic IP to communicate. It scales automatically and has no bandwidth limit or hourly charge.
For IPv6, use an egress-only internet gateway to allow outbound IPv6 without allowing inbound connections, the IPv6 equivalent of NAT behavior.
NAT gateway
A NAT gateway lets private resources start connections to the internet while staying unreachable from it. It lives in a public subnet with an Elastic IP; private route tables send 0.0.0.0/0 to it.
- It is zonal: deploy one per AZ and route each AZ's private subnets to their local NAT gateway, or an AZ outage cuts every zone's internet access, and cross-AZ traffic adds charges.
- You pay an hourly fee per NAT gateway plus a per-GB processing fee, in addition to normal data transfer.
- Private NAT gateways (no Elastic IP) translate between VPCs or to on-premises networks, for example to connect overlapping CIDR ranges.
Gateway endpoints: free private access to S3 and DynamoDB
A gateway endpoint adds routes for S3 or DynamoDB prefix lists to the route tables you choose. Traffic to those services then flows over the AWS network instead of through the NAT gateway. It costs nothing.
This is the single easiest cost win in many accounts: a private fleet pulling large objects from S3 through a NAT gateway pays NAT processing for every GB. Add an S3 gateway endpoint and that charge disappears for same-Region traffic.
Gateway endpoints only work from within the VPC and for the same Region; they do not extend to on-premises networks or peered VPCs.
Interface endpoints (AWS PrivateLink)
An interface endpoint places elastic network interfaces with private IPs in your subnets for a specific service (STS, Secrets Manager, SSM, ECR, CloudWatch Logs, KMS and many more, plus partner and your own PrivateLink services). With private DNS enabled, the normal service hostname resolves to those private IPs, so your code needs no changes.
- Needed for fully private subnets with no internet path at all (for example, ECS tasks pulling from ECR need the ECR, S3 and CloudWatch Logs endpoints).
- Charged per hour per AZ and per GB. For a handful of services in a few AZs this is modest; dozens of endpoints in many VPCs add up, which is why larger organizations centralize them in a shared services VPC.
- Protected by security groups, and controllable with endpoint policies that restrict which resources can be reached.
Endpoint policies and bucket policies together
Endpoints enable strong data perimeter controls. An endpoint policy can allow access only to your organization's buckets, and a bucket policy can deny requests that do not arrive through your VPC endpoint (aws:SourceVpce). Together they stop data from leaving through unapproved paths.
Designing for cost
- Add the S3 and DynamoDB gateway endpoints to every VPC. They are free.
- Use one NAT gateway per AZ in production; consider a single one for dev and test.
- Check NAT gateway
BytesOutToDestinationand VPC Flow Logs to see what really uses the NAT, then decide whether an interface endpoint or a shared egress VPC is cheaper. - Avoid sending traffic across AZs to reach a NAT gateway or endpoint.
Practice it
Cut transfer costs in Cut Data Transfer Cost: VPC Endpoints and Shared NAT Design, build a private-only network in Private-Only VPC: Interface and Gateway Endpoints with Endpoint Policies and share endpoints across VPCs in Centralized VPC Interface Endpoints. Then troubleshoot Private Workers Have No Internet Despite a NAT Route.
FAQ
Can I use a NAT instance instead of a NAT gateway?
Yes, an EC2 instance can do NAT and is cheaper for tiny workloads, but you manage its availability, patching and bandwidth. NAT gateways are the managed default.
Do VPC endpoints work for traffic from on-premises?
Interface endpoints do, over VPN or Direct Connect. Gateway endpoints do not.