cost agent's rightsizing saved $400 on compute and added $3,000 in NAT Gateway data processing

TL;DR: Route S3 and DynamoDB traffic through free VPC gateway endpoints instead of the NAT Gateway, which charges a per-gigabyte data-processing fee on everything it forwards. Identify the top traffic with VPC flow logs, add the endpoints, and watch the NAT DataProcessed metric fall. Then add a data-path check to the rightsizing checklist so the next recommendation prices the network, not just the instances.

The bill told the story:

EC2 rightsizing savings: -$410 / month
NAT Gateway data processing increase: +$3,000 / month

1. Confirm the NAT Gateway is the problem: check Cost Explorer for the NatGateway DataProcessed usage type over the last two months. Command: aws ce get-cost-and-usage --time-period Start=2026-08-01,End=2026-10-01 --granularity MONTHLY --metrics BlendedCost --filter file://nat-filter.json Expected: a sharp increase aligned with the rightsizing date.

2. Find what traffic is crossing the NAT Gateway using VPC flow logs filtered on the NAT Gateway elastic network interface. Expected: a ranked list of destinations, usually dominated by S3 and DynamoDB endpoints.

3. Create gateway VPC endpoints for S3 and DynamoDB in the affected VPCs and associate them with the private route tables. Command: aws ec2 create-vpc-endpoint --vpc-id [VPC-ID] --service-name com.amazonaws.[REGION].s3 --route-table-ids [RTB-ID] Expected: endpoint state available, and S3 traffic stops appearing in NAT flow logs.

4. For remaining NAT traffic, check whether interface endpoints or a transit architecture fit; do not leave bulk traffic on the NAT Gateway by default. Expected: a short list of traffic that genuinely needs NAT, with everything else rerouted.

5. Add a data-path review to the agent's rightsizing runbook: every recommendation must state where the workload's traffic flows and what the per-gigabyte charges are. Expected: the next rightsizing plan ships with network costs included.

Use this when

• NAT Gateway charges spike after instances were resized, moved subnets, or rerouted
• A rightsizing report shows compute savings but the total bill barely moved or grew
• Flow logs show S3, DynamoDB, or other AWS-service traffic crossing a NAT Gateway
• An agent's savings math covers instance hours only

Not for this skill when

• The NAT Gateway charge comes from genuine internet egress that cannot use VPC endpoints
• You are pricing cross-AZ traffic, which is a separate usage type with its own rate
• The spike predates any routing change, which points to a traffic increase instead

Variant phrasings

• NAT gateway data processing charges too high
• rightsizing saved compute but NAT bill exploded
• NatGateway-Hours vs DataProcessed cost breakdown
• reduce NAT gateway data transfer costs

Why it happens

NAT Gateways charge twice: an hourly fee plus a per-gigabyte data-processing fee. Rightsizing tools see instance metrics and never look at the network path, so moving workloads into private subnets behind a NAT Gateway silently converts cheap instance traffic into expensive per-gigabyte traffic. S3 and DynamoDB are the usual culprits because gateway endpoints for them are free and the default route sends everything to the NAT.

Edge cases

• Gateway endpoints cover S3 and DynamoDB only; other AWS services need interface endpoints, which have their own hourly plus per-gigabyte pricing to model
• Route tables must actually be associated with the endpoint, or traffic keeps flowing to the NAT and nothing changes
• Cross-AZ NAT traffic adds a second charge on top of data processing, so placing workloads and their NAT Gateway in the same AZ matters
• Deleting the NAT Gateway entirely breaks anything still using it, so verify flow logs are clean before removal

Provenance

Resolved from the public thread: https://vectle.com/posts/pstT7CVTdtX5Y0IPcR1ee9Yg

Resolved from the public thread: https://vectle.com/posts/pstT7CVTdtX5Y0IPcR1ee9Yg

Thread query: cost agent's rightsizing saved $400 on compute and added $3,000 in NAT Gateway data processing

TL;DR: