nat-triple · Educational

Cloud egress: VPC endpoints vs NAT Gateway path matrix

Q: Where is the PrivateLink vs NAT deep-dive?

Interface / PrivateLink bill-line detail lives on the PrivateLink endpoint vs NAT egress spoke. This matrix stays the gateway+interface overview. Model both with Mode B (?path=privatelink-vs-nat).

VPC gateway endpoints (e.g. S3/DynamoDB) and interface endpoints (PrivateLink) can move AWS-bound traffic off a NAT Gateway — trading NAT hourly/processing/Internet DT-out for endpoint hours, ENI, or private-path fees. Compare stacks with Mode B; keep rates Unknown until verified.

Updated 2026-09-16

Gateway and interface VPC endpoints can shift AWS-bound traffic off NAT — compare endpoint fees to the NAT triple-charge stack.

Path matrix: VPC endpoints vs NAT Gateway (educational)
Path	Meters to model	Best when	FinOps note
Private subnet → NAT → Internet/AWS public	Hourly + processing + Internet DT-out (+ cross-AZ hairpin)	True Internet destinations	Triple-charge pattern
Private subnet → gateway endpoint → S3/DynamoDB	Endpoint policy/ops; often no NAT for that prefix	Heavy AWS-managed object/DB API pulls	Gateway endpoints are prefix-based
Private subnet → interface endpoint → AWS APIs	Endpoint hourly / ENI / PrivateLink-style GB	Private API access without IGW	Per-AZ endpoint sprawl multiplies hours
Public subnet → IGW	Internet DT-out; no NAT processing	Hardened public workloads	Security groups ≠ cost model
Hybrid: endpoints for AWS + NAT for Internet	Both stacks on one bill	Mixed destinations	Split bytes by destination class

Sources (official AWS docs)

AWS VPC pricing (NAT & endpoints) — as-of 2026-09-09 Unknown until verified
AWS PrivateLink / interface endpoint concepts — as-of 2026-09-09
AWS gateway endpoints — as-of 2026-09-09
AWS data transfer / EC2 pricing — as-of 2026-09-09 Unknown until verified

Dated starting points only — Unknown until verified means no invented $/GB. Gateway vs interface coverage lives on this one spoke — no thin duplicate URLs.

This matrix covers both gateway endpoints and interface / PrivateLink-style endpoints versus NAT Gateway on one page — avoiding thin duplicate URLs. For a deeper interface/PrivateLink vs NAT egress bill-line map, open the PrivateLink vs NAT egress spoke. Educational FinOps-lite only; not a broker quote.

Path templates to model

S3 GET via gateway endpoint — often removes NAT for that prefix; still model request ops and any DT nuances.
AWS API via interface endpoint — trades NAT for endpoint hours/ENI/private GB; multiply by AZ count.
Third-party SaaS HTTPS — still needs NAT or equivalent Internet path; endpoints do not cover arbitrary destinations.
Cross-AZ hairpin to a single NAT — adds cross-AZ on top of the triple-charge stack.
Hybrid routing — classify destinations; price endpoint stack and NAT stack as separate lines.

Common traps

Enabling one S3 gateway endpoint and declaring “NAT solved.” Spawning interface endpoints in every AZ “for HA” without measuring bytes. Comparing only Internet $/GB while ignoring NAT hourly. Assuming PrivateLink zeros cross-AZ. Treating S3 CRR as an endpoint win conflates replication with private API paths. Blending gateway and interface fees into one cell hides which stack actually moved. No guaranteed savings from endpoint adoption.

“One gateway endpoint = NAT solved” — gateway prefixes cover specific AWS services (classic S3/DynamoDB). Arbitrary SaaS HTTPS still needs NAT, IGW, or another Internet path. Split AWS-bound vs true-Internet bytes before celebrating.
Interface sprawl “for HA” — per-AZ interface/PrivateLink endpoints multiply hourly/ENI lines. Measure chatter GB first; HA without bytes is an hours tax, not an automatic win. Sibling deep-dive: PrivateLink vs NAT egress.
Internet $/GB only — ignoring NAT hourly + processing misses the triple-charge pattern. Mode B exists to keep three meters visible; open ?path=nat before endpoint arithmetic.
PrivateLink zeros cross-AZ — moving API traffic onto interface endpoints does not erase InterZone chatter elsewhere in the VPC. Keep cross-AZ as its own line; sibling cross-AZ vs cross-region.
CRR as an “endpoint win” — bucket→bucket replication is not a private API path and not NAT avoidance for Internet clients. Use the S3 CRR spoke alone.
Gateway fee blended with interface hours — prefix-based gateway endpoint economics and per-AZ interface/ENI hours are different meters. Never one blended cell; keep residual NAT triple-charge separate when SaaS still exits the VPC.
Policy/route miss after endpoint create — an endpoint that exists but is not in route tables / endpoint policies still leaves bytes on NAT. Verify destination class before claiming a shift.
Incomplete → crown — Unknown / Incomplete cells stay Unknown. PipeToll never invents endpoint or NAT $/GB. Stay FinOps-lite. Badge Unknown until verified.

FinOps checklist

Export NAT bytes/hours by AZ for 30–90 days; split AWS-bound vs true Internet.
Candidate gateway endpoints for S3/DynamoDB-heavy prefixes.
Candidate interface endpoints only for high-chatter AWS APIs — count AZs.
Model NAT with calculator Mode B; keep endpoint rates Unknown until dated.
Sibling-check NAT vs IGW and the free-tier cliff; read methodology.

Glossary: NAT processing, IGW, path template, VPC endpoint.

FinOps-lite Unknown until verified

Worked example (educational): 1,500 GB AWS-bound via NAT vs endpoint shift

Baseline: 1,500 GB/month S3 API pulls traverse NAT (processing + Internet DT-out) plus 730 NAT hours.
Line NAT hourly — rate Unknown; line NAT processing×1,500 GB — rate Unknown; line Internet DT-out×1,500 GB — rate Unknown.
Candidate shift: gateway endpoint for the S3 prefix — endpoint fee line Unknown (no invented $/GB).
If interface endpoints are needed for other APIs, add per-AZ endpoint hours/ENI — rates Unknown.
Compare stacks with Mode B; do not claim savings without dated cites. Educational only.

Numbered NAT vs endpoint shift — Unknown rate cells
#	Scenario line	Volume	Unit rate
1	NAT hourly (baseline)	730 h	Unknown $/hour
2	NAT processing (baseline)	1,500 GB	Unknown $/GB
3	Internet DT-out (baseline)	1,500 GB	Unknown $/GB
4	Gateway endpoint fees (shift)	same prefix	Unknown
5	Interface endpoint hours (optional)	per AZ	Unknown

Second educational stack (interface/PrivateLink twin): 800 GB/month AWS API chatter that today traverses NAT (processing + Internet DT-out) plus shared NAT hours. Candidate shift: interface endpoints in two AZs — endpoint hourly/ENI lines Unknown; remaining true-Internet bytes stay on NAT. Compare with Mode B (?path=privatelink-vs-nat) and the deep-dive PrivateLink vs NAT egress spoke — do not invent PrivateLink $/GB. Synthetic only; no savings guarantee.

Worked-estimate sensitivity (educational)

Hold the 1,500 GB S3-bound baseline and walk four architecture runs. Every unit rate stays Unknown until dated VPC/EC2 cites — literacy arithmetic, not a quote or ROI. Treat gateway fees, interface hours/ENI, and residual NAT triple-charge as separate lines; never one blended cell.

Run A — NAT only: 730 NAT hours + 1,500 GB processing + 1,500 GB Internet DT-out (if the public endpoint path still fires). Open Mode B (?path=nat). This is the triple-charge baseline before any endpoint shift.
Run B — gateway endpoint shift: same 1,500 GB S3 prefix via gateway endpoint — drop NAT processing/Internet for that prefix; keep residual NAT for true-Internet control-plane and SaaS. Endpoint fee line Unknown. Confirm route-table / endpoint-policy coverage before claiming the shift.
Run C — hybrid + 2-AZ interface: gateway for S3 + interface endpoints in two AZs for other APIs + residual NAT for SaaS. Sum endpoint hours/ENI + residual NAT triple-charge separately. Use ?path=privatelink-vs-nat and the PrivateLink deep-dive.
Run D — volume twin (3,000 GB S3-bound): double the AWS-bound prefix while holding AZ count and residual SaaS bytes fixed. Re-run B then C; watch whether gateway economics dominate or interface hours/ENI sprawl still dwarfs processing savings. Free-tier Internet cliffs stay beside residual NAT via AWS free-tier cliff — do not invent cliff $/GB.

Sensitivity runs — Unknown rates (educational)
Run	What changes	Meters to keep visible	Unit rates
A	All AWS-bound via NAT	Hours + processing + Internet DT-out	Unknown
B	S3 prefix → gateway endpoint	Endpoint fees + residual NAT	Unknown
C	Gateway + 2-AZ interface + residual NAT	Endpoint hours/ENI × AZ + residual NAT stack	Unknown
D	Volume twin 3,000 GB S3-bound (B/C shape)	Same meters; scale prefix GB only	Unknown

Map CE labels with the Cost Explorer decoder; sibling checklist literacy on AWS egress path checklist and NAT vs IGW. Cross-AZ chatter that survives an endpoint shift still belongs on its own line — see cross-AZ vs cross-region. Badge every unverified rate Unknown until verified. No savings guarantee.

Open calculator Mode B Mode B · path=privatelink-vs-nat PrivateLink deep-dive Cost Explorer decoder

FAQ on this path

Do VPC endpoints replace NAT for all traffic?

No. Gateway and interface endpoints cover specific AWS services/prefixes. Arbitrary Internet destinations still need NAT, IGW, or another egress path.

Gateway vs interface — which spoke?

Both live on this matrix. Gateway endpoints are prefix-based (classic S3/DynamoDB); interface endpoints are ENI/PrivateLink-style. PipeToll avoids thin duplicate URLs.

Will endpoints guarantee lower spend?

No. PipeToll never guarantees savings. Measure bytes, AZ count, and dated fees before changing architecture.

Where is the PrivateLink vs NAT deep-dive?

Interface / PrivateLink bill-line detail lives on PrivateLink endpoint vs NAT egress. This matrix stays the gateway+interface overview. Model both with Mode B (?path=privatelink-vs-nat) and map CE labels on the Cost Explorer decoder.

Which calculator path for endpoint vs NAT?

Use Mode B ?path=nat for the classic triple-charge baseline, and ?path=privatelink / ?path=privatelink-vs-nat when interface endpoints are the candidate shift. Keep rates Unknown until verified.

Trademarks: Amazon Web Services, AWS, Microsoft Azure, Google Cloud Platform, GCP, and Cloudflare are trademarks of their respective owners. PipeToll (Ameti One LLC) is not affiliated with, endorsed by, or sponsored by those companies. Educational comparisons may be outdated — verify current rates with each provider.