nat-triple · Educational

Cloud egress: AWS NAT Gateway vs Internet Gateway triple-charge

Private-subnet Internet access via NAT Gateway can stack hourly + processing + Internet DT-out (the triple-charge pattern); an Internet Gateway avoids NAT fees but not necessarily Internet DT-out. Model stacks separately — Unknown until verified.

Updated 2026-09-16

Private-subnet Internet access via NAT can stack hourly + processing + egress — the triple-charge pattern FinOps teams miss.

Path matrix: AWS NAT Gateway vs Internet Gateway cost layers (educational)
Cost layer	NAT Gateway path	Public subnet + IGW path	FinOps note
Hourly / provisioned	NAT Gateway hourly per AZ	Usually none for IGW itself	Multi-AZ NAT multiplies hours
Data processing $/GB	NAT processing on bytes through GW	No NAT processing	Often overlooked
Internet egress $/GB	Still billed on Internet DT-out	Internet DT-out from instance/ELB	Same cliff math
AZ hairpin risk	Cross-AZ to NAT adds cross-AZ DT	Keep IGW local to AZ	Topology matters
IPv6 / egress-only	Alternate designs exist	Public IPv6 options	Architecture review

Sources (official AWS docs)

Amazon VPC pricing (NAT Gateway) — as-of 2026-09-09 Unknown until verified
NAT gateways — AWS VPC User Guide — as-of 2026-09-09
Amazon EC2 On-Demand pricing (data transfer) — as-of 2026-09-09 Unknown until verified
Internet gateways — AWS VPC User Guide — as-of 2026-09-09

Dated official starting points only — Unknown until verified means no invented $/GB. PipeToll does not scrape private consoles or guarantee figures.

Path-class vocabulary: path template, triple-charge pattern, NAT Gateway processing, Internet Gateway (IGW), egress (DT-out), cross-AZ transfer, free-tier cliff, VPC endpoint, FinOps-lite, and Unknown until verified. Triple-charge pattern (educational): (1) NAT Gateway hourly, (2) NAT per-GB processing, (3) Internet data-transfer-out — plus cross-AZ if NAT sits in another AZ. PipeToll names each meter before any $/GB arithmetic.

Path templates to model

Private subnet → NAT → Internet — classic triple-charge candidate; count hours and GB separately.
Private subnet → VPC gateway endpoint → S3 — often avoids NAT for S3 API pulls; still model endpoint/request SKUs.
Private subnet → interface endpoint → AWS APIs — trades NAT for PrivateLink-style fees; compare path totals.
Public subnet → IGW → Internet — no NAT processing; harden security groups and still meter Internet DT-out.
Cross-AZ hairpin to a single NAT — adds cross-AZ data transfer on top of NAT stack.

Common traps

Egress-only compare — Comparing only Internet egress $/GB hides NAT hourly and processing. Stack the triple-charge before any Mode A Internet cell.
Multi-AZ hours without bytes — Placing a NAT “for HA” in every AZ can triple Gateway hours even when most GB still hairpin through one AZ. Hours multiply independently of processing GB.
Cliff after NAT ignored — Free-tier cliffs on Internet DT-out still apply after NAT processing. Processing does not erase the complimentary DT-out allotment cliff.
Endpoint magic zero — VPC endpoints / PrivateLink shift AWS-bound chatter off NAT; they do not magically zero every bill line (hours, ENI, private GB remain).
Hairpin called free HA — A single-AZ NAT with a cross-AZ hairpin from other zones is a fourth meter, not “free HA.”
IGW = free Internet — Public subnet + IGW avoids NAT fees but not Internet DT-out from instances/ELB. Threat-model constraints still apply — no architecture here is a guaranteed savings claim.

FinOps checklist

Export NAT Gateway bytes and hours by AZ for the last 30–90 days.
Separate AWS-bound API traffic (endpoint candidates) from true Internet destinations.
Model hourly×hours + processing×GB + egress×GB as three lines — use calculator Mode B.
Re-price after endpoint or IGW redesign; keep Unknown until rates are dated.
Document threat-model constraints so “move to public subnet” is not a blind cost-only change.

See also NAT Gateway processing, triple-charge, path template, and methodology for Unknown-until-verified discipline. Decode confusing CE labels on the Cost Explorer DT decoder.

FinOps-lite Unknown until verified

Worked example (educational): 2,000 GB via NAT in one month

Count 730 NAT Gateway hours in one AZ — hourly rate cell Unknown until cited from VPC pricing.
Measure 2,000 GB NAT processing — processing $/GB cell Unknown.
Measure the same 2,000 GB Internet DT-out after NAT — Internet $/GB cell Unknown (watch free-tier cliff).
If the NAT sits in another AZ, add cross-AZ GB as a fourth line — rate Unknown.
Stack = hourly×hours + processing×GB + egress×GB (+ cross-AZ). Synthetic only — not a quote or savings guarantee.

Numbered NAT triple-charge stack — Unknown rate cells
#	Meter	Volume	Unit rate
1	NAT Gateway hourly	730 h	Unknown $/hour
2	NAT processing	2,000 GB	Unknown $/GB
3	Internet DT-out	2,000 GB	Unknown $/GB
4	Cross-AZ hairpin (optional)	as measured	Unknown $/GB

Third educational stack (multi-AZ NAT hours): same 2,000 GB Internet DT-out, but HA places a NAT in three AZs → ≈ 2,190 Gateway hours (3 × 730) even when most bytes still hairpin through one AZ. Re-run Mode B (?path=nat) with hours×3; keep processing/egress GB on the measured path; add cross-AZ GB if private subnets reach a remote NAT. Hours multiply independently of GB — that is the HA tax FinOps misses. Synthetic only — Unknown rates until dated; no savings guarantee.

Worked-estimate sensitivity (educational)

Hold the 2,000 GB Internet DT-out baseline and walk three NAT / IGW runs. Hourly, processing, and Internet $/GB cells stay Unknown until dated VPC / EC2 cites — literacy arithmetic, not a quote.

Run A — Single-AZ NAT triple-charge: 730 Gateway hours + 2,000 GB processing + 2,000 GB Internet DT-out. Open Mode B (?path=nat). Keep cross-AZ at zero when NAT is local to the private subnet AZ.
Run B — Multi-AZ NAT hours twin: same 2,000 GB processing/egress, but HA places NAT in three AZs → ≈ 2,190 Gateway hours (3 × 730). Re-run Mode B with hours×3; add cross-AZ GB if private subnets reach a remote NAT.
Run C — IGW / endpoint sibling: move AWS-bound chatter to VPC endpoints / PrivateLink and true Internet via public subnet + IGW (or keep residual NAT only for non-AWS destinations). Model endpoint hours/ENI separately; Internet DT-out still cliffs — sibling AWS free-tier cliff and VPC endpoints vs NAT.

Sensitivity runs — Unknown rates (educational)
Run	What changes	Meters to keep visible	Unit rates
A	Single-AZ NAT · 2,000 GB stack	Hourly · processing · Internet DT-out	Unknown
B	3-AZ NAT hours twin (2,190 h)	Hours×3 · processing/egress · optional cross-AZ hairpin	Unknown
C	IGW / endpoint sibling path	Endpoint hours/ENI · residual NAT · Internet cliff	Unknown

Cross-read VPC endpoints vs NAT, PrivateLink vs NAT, cross-AZ vs cross-region, Cost Explorer decoder, and methodology. Badge every unverified rate Unknown until verified. No savings guarantee.

Open calculator Mode B Cost Explorer decoder Cross-AZ vs cross-region S3 CRR (not NAT)

FAQ on this path

What is the NAT triple-charge pattern?

Educationally: (1) NAT Gateway hourly charge, (2) per-GB NAT processing, (3) Internet data-transfer-out — plus optional cross-AZ if the NAT sits in another AZ. Always verify current SKUs.

Does an Internet Gateway remove all egress cost?

No. IGW avoids NAT hourly/processing, but Internet data-transfer-out from public instances or load balancers can still apply. Path matters.

Should I always add per-AZ NAT?

Only when AZ-isolated failure domains require it. Extra NAT hours multiply cost; measure bytes and availability needs first. Model multi-AZ hours in Mode B (?path=nat).

What is a cross-AZ NAT hairpin?

When private subnets in AZ-A route Internet via a NAT in AZ-B, bytes can pick up cross-AZ transfer on top of the triple-charge stack (hourly + processing + Internet DT-out). Keep the hairpin as a fourth line — see cross-AZ vs cross-region and map CE labels on the Cost Explorer decoder.

Trademarks: Amazon Web Services, AWS, Microsoft Azure, Google Cloud Platform, GCP, and Cloudflare are trademarks of their respective owners. PipeToll (Ameti One LLC) is not affiliated with, endorsed by, or sponsored by those companies. Educational comparisons may be outdated — verify current rates with each provider.