AUGUST 12, 2026 • 8 MIN READ • CLOUD COST ARCHITECTURE

Why AWS NAT Gateways Are a $0.045/GB Tax (And How GressTrace Attributes It)

If you run Kubernetes on AWS EKS or custom VPCs, you have likely encountered the end-of-month AWS invoice surprise: NAT Gateway Data Processing Charges.

The Hidden Arithmetic of NAT Gateway Fees

AWS charges $0.045 per GB for data processed by a NAT Gateway in most regions (`us-east-1`, `us-west-2`), on top of standard EC2 internet egress rates ($0.09/GB). If a microservice pod in a private subnet downloads 100 TB of external data or external API responses in a month, the NAT Gateway fee alone equals:

nat_cost_math.txt

100,000 GB × $0.045 = $4,500.00 / month (Just NAT Processing)
+ Standard Internet Egress Fees ($0.09/GB) = $9,000.00 / month
Total Network Cost = $13,500.00 / month

The Cross-AZ Routing Trap

If your EKS cluster spans multiple Availability Zones (`us-west-2a`, `us-west-2b`, `us-west-2c`), a pod in `us-west-2b` communicating with a NAT Gateway in `us-west-2a` incurs an additional $0.02/GB Cross-AZ data transfer charge ($0.01/GB out + $0.01/GB in).

How GressTrace Root-Causes the Leak

GressTrace monitors socket allocations and OpenCost `/allocation/compute` telemetry out-of-band. When an egress spike exceeds statistical Z-score thresholds ($Z > 2.0$), GressTrace checks Kubernetes audit logs within a ±30 minute window and highlights the exact deployment commit that caused the spike:

incident_evidence.json

[Incident #GT-101]
Workload: ecommerce/cart-service
Baseline: $15.00/hr
Current Spike: $560.00/hr (+3,633%)
Root Cause: Deployment 'cart-service' updated to image 'v2.1.0' (Git SHA: 7a3b1c)
Details: ConfigMap change increased external API retry loop count from 3 to 10

Start Attributing Your Network Egress Costs

Join the GressTrace waitlist to get 14 days of free trial access on launch day.

Join Waitlist