Synopsis
A large NAT charge tells you where to look, not what to change
NAT gateways carry hourly and data-processing charges that vary by region. A large line item deserves attention, but it does not make an endpoint or topology change automatically safe.
Observation
Keep the observed cost separate from the run-rate
Suppose CUR shows USD 3,200 of NAT gateway charges for one completed month. That is observed billing evidence. Multiplying by 12 gives a USD 38,400 run-rate estimate, not an observed annual cost and not a forecast of future traffic.
Diagnostics
Reconstruct the traffic path
- Break charges down by account, region, availability zone, and usage type.
- Use NAT gateway CloudWatch metrics to establish bytes and connection volume.
- Use VPC Flow Logs and route tables to identify likely sources, destinations, and paths.
- Check for cross-AZ routing, centralized egress, inspection appliances, and endpoint availability.
- Price candidate architectures in the actual region.
Limits
The right change depends on where the traffic is going
S3 and DynamoDB gateway endpoints differ from interface endpoints. Internet, third-party, cross-region, and inspected traffic may still require NAT or another egress path. Security, resilience, DNS, routing, and operational ownership belong in the decision.
Kulshan
Join billing evidence to network context carefully
Kulshan can surface NAT-related cost evidence and read-only VPC context. It marks interpretation for human review because the safe remediation depends on the real traffic path.
Keep reading