Dated starting points only — Unknown until verified means no invented $/GB. PipeToll does not scrape private consoles or guarantee figures.
Path-class vocabulary: path template, Unknown until verified. Triple-charge pattern (educational): (1) NAT Gateway hourly, (2) NAT per-GB processing, (3) Internet data-transfer-out — plus cross-AZ if NAT sits in another AZ. PipeToll names each meter before any $/GB arithmetic.
Path templates to model
Private subnet → NAT → Internet — classic triple-charge candidate; count hours and GB separately.
Private subnet → VPC gateway endpoint → S3 — often avoids NAT for S3 API pulls; still model endpoint/request SKUs.
Public subnet → IGW → Internet — no NAT processing; harden security groups and still meter Internet DT-out.
Cross-AZ hairpin to a single NAT — adds cross-AZ data transfer on top of NAT stack.
Common traps
Comparing only Internet egress $/GB hides NAT hourly and processing. Multi-AZ “for HA” without measuring bytes can triple hours. Free-tier cliffs on Internet DT-out still apply after NAT processing. VPC endpoints shift cost — they do not magically zero every bill line. No architecture here is a guaranteed savings claim.
FinOps checklist
Export NAT Gateway bytes and hours by AZ for the last 30–90 days.
Separate AWS-bound API traffic (endpoint candidates) from true Internet destinations.
Model hourly×hours + processing×GB + egress×GB as three lines — use calculator Mode B.
Re-price after endpoint or IGW redesign; keep Unknown until rates are dated.
Document threat-model constraints so “move to public subnet” is not a blind cost-only change.
Worked example (educational): 2,000 GB via NAT in one month
Assume one NAT Gateway runs 730 hours at an example Unknown hourly rate you paste from the provider page, 2,000 GB of NAT processing, and the same 2,000 GB still incur Internet data-transfer-out. Stack = hourly×hours + processing×GB + egress×GB. This is synthetic arithmetic — not a quote and not a savings guarantee.
Educationally: (1) NAT Gateway hourly charge, (2) per-GB NAT processing, (3) Internet data-transfer-out — plus optional cross-AZ if the NAT sits in another AZ. Always verify current SKUs.
Does an Internet Gateway remove all egress cost?
No. IGW avoids NAT hourly/processing, but Internet data-transfer-out from public instances or load balancers can still apply. Path matters.
Should I always add per-AZ NAT?
Only when AZ-isolated failure domains require it. Extra NAT hours multiply cost; measure bytes and availability needs first.
