All cheat sheets
Networkingcheat sheet

NAT Gateway Consolidation

Every VPC running its own NAT Gateways pays ~$32/month per AZ before data charges. One shared egress VPC behind a Transit Gateway replaces most of them — typically saving $3,000–$10,000+ a year at 3+ VPCs.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided NAT Gateway Consolidation walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: NAT Gateways cost ~$32/month per AZ just existing, plus $0.045/GB processed — and the default architecture gives every VPC its own pair. Five VPCs × 2 AZs = $3,840/year of pure idle. Consolidation routes all VPCs' internet-bound traffic through one shared "egress VPC" behind a Transit Gateway: 10 NAT Gateways become 2, transparently to applications (it's just routing). TGW data processing ($0.02/GB) is also cheaper than NAT's per-GB rate.

The numbers

Worked example — 6 VPCs, 2 AZs each, 20 TB/month:

Before After consolidation
NAT hourly 12 × $32 = $394/mo 2 × $32 = $65/mo
Data processing $900/mo (NAT $0.045/GB) $600/mo (TGW $0.02/GB)
TGW attachments — ~$75/mo
Total $1,294/mo ~$1,040/mo

That's the conservative case (~$3,000/year); orgs with more VPCs commonly see 50–70% cuts, and the multi-account SaaS scenario in the full workflow saves $13k+/year. Break-even rule of thumb: consolidation pays when you're eliminating 4+ NAT Gateways.

Do this

  1. Two-minute audit first: Cost Explorer → filter to NAT Gateway → split hourly vs data processing. That number decides everything.

  2. Peel off S3/DynamoDB traffic before consolidating — free Gateway Endpoints often remove half the data-processing charge and change the math.

  3. Build the hub: create a Transit Gateway; set up one egress VPC with NAT Gateways in 2+ AZs (NAT is zonal — one AZ is an outage waiting); attach the spoke VPCs.

  4. Reroute: spoke VPC route tables send 0.0.0.0/0 → Transit Gateway; egress VPC routes spoke traffic through its NAT Gateways. Test connectivity per spoke, then delete the old NAT Gateways.

  5. After cutover, watch attribution: if one VPC drives 90% of TGW data costs, optimize it specifically.

Gotchas

  • Attachment fees are always-on (~$36/month per VPC). Don't attach isolated VPCs that never talk to the internet — they'd pay for nothing.
  • Security groups/NACLs: spokes must allow outbound to TGW ranges; egress NAT must accept spoke CIDRs. Miss this and you'll debug rejected packets in VPC Flow Logs for an hour.
  • Asymmetric routing: spoke VPCs keeping their own Internet Gateways risk split paths. Best practice: the egress VPC handles all outbound; spokes get zero direct internet.
  • Throughput ceiling: 50 Gbps per TGW attachment — rarely hit, but monitor BytesOutToDestination when consolidating heavy VPCs.
  • Once the TGW exists, it pays dividends beyond NAT: centralized routing, simpler inter-VPC connectivity, hybrid on-ramp.

Skip this if

  • You run one VPC — nothing to consolidate (but bookmark it for when environments multiply).
  • You'd eliminate fewer than ~4 NAT Gateways — attachment fees can eat the win; model it first.
  • Your NAT bill is dominated by S3/DynamoDB data processing — Gateway Endpoints alone may solve it for free.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account (or org) for NAT Gateway consolidation
savings. Use the AWS CLI with READ-ONLY credentials. Do not create,
modify, or delete anything — report findings and recommended
(unapplied) fixes only.

1. Inventory per region: aws ec2 describe-nat-gateways
   --filter Name=state,Values=available — capture VPC, subnet/AZ, and
   tags. Also aws ec2 describe-vpcs for the VPC count and
   describe-transit-gateways / describe-transit-gateway-attachments for
   any existing TGW.
2. Traffic split: CloudWatch NAT metrics (BytesOutToDestination,
   BytesInFromSource) per NAT gateway over 30 days, to separate hourly
   waste from data-processing spend.
3. Cost model (us-east-1): NAT hourly $0.045/h (~$32/mo per gateway),
   NAT data processing $0.045/GB; consolidated alternative = 2 NAT
   gateways in one egress VPC + TGW attachments $0.05/h (~$36/mo per
   attached VPC) + TGW data $0.02/GB. Compute break-even: consolidation
   usually wins when eliminating 4+ NAT gateways.
4. Quick adjacent win: any NAT gateway whose traffic is dominated by S3
   or DynamoDB should get free Gateway Endpoints FIRST — recompute the
   consolidation math after that traffic is removed.

Report: NAT inventory table (gateway | VPC | AZ | $/mo hourly |
GB/mo data | $/mo data), current total vs modeled consolidated total,
which VPCs to attach vs leave alone (isolated DB VPCs shouldn't pay
attachment fees), and migration order-of-operations. Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The NAT Gateway Consolidation walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.