VPC Cost Insights
A NAT Gateway bills for every hour it exists and again for every GB it processes — and traffic from private subnets to S3 or DynamoDB often flows through it for no reason, because a free Gateway Endpoint would carry the same traffic at no charge. CloudPouch VPC Cost Insights find both problems: NAT Gateways that are not earning their bill, and endpoint changes that would shrink the data-processing charge.
What CloudPouch checks
Section titled “What CloudPouch checks”- Unnecessary NAT Gateways, identified from CloudWatch metrics rather than configuration alone.
- VPC Gateway Endpoint and Interface Endpoint opportunities — places where an endpoint would remove traffic from the NAT path.
- Expensive data transfer paths that endpoint changes could reduce.
- NAT Gateway
BytesOutToDestinationcontext, with CloudWatch graph links for investigation.
Why this costs money
Section titled “Why this costs money”NAT Gateway pricing has two meters: an hourly charge that runs even at zero traffic, and a per-GB data-processing charge on everything that passes through. Multiply by one NAT Gateway per availability zone per VPC and the hourly charges alone add up across an account. The per-GB meter is worse: workloads in private subnets that talk to S3, DynamoDB, or other AWS APIs often route through the NAT Gateway by default, paying data-processing fees for traffic that never needed to leave the AWS network. Gateway Endpoints for S3 and DynamoDB are free; Interface Endpoints have their own hourly and per-GB charges but usually undercut NAT for AWS API traffic. Current rates are on the AWS VPC pricing page.
Before you change anything
Section titled “Before you change anything”NAT Gateway traffic is not always attributable to a specific EC2 instance. AWS Fargate tasks and Lambda functions in a VPC also send their outbound traffic through the NAT Gateway, so a “quiet” gateway from the EC2 perspective may still carry serverless traffic. Review BytesOutToDestination and check which services live in the affected subnets before deleting a NAT Gateway or rerouting through endpoints.
When to use it
Section titled “When to use it”Run this insight when EC2-Other or data-transfer lines grow in your bill without an obvious cause, or as a standard pass over any account with private subnets — the S3-through-NAT pattern is one of the most common silent costs in AWS.
Required AWS permissions
Section titled “Required AWS permissions”CloudPouch needs read-only access to EC2 and VPC networking metadata, CloudWatch NAT Gateway metrics, and cost data. See AWS permissions.