Use this runbook when NAT Gateway, Azure NAT gateway, Cloud NAT or Alibaba NAT is the service or meter that moved on the bill. First action: list every NAT in the affected VPC or VNet and pull processed-bytes metrics for the same window as the cost rise. Hourly gateway charges rise when someone added NATs. Byte charges rise when private subnets started sending more internet or cross-service traffic through the NAT. Do not delete a production NAT until you have another egress path. Confirm the usage type is data processing or gateway hours before you change routes.

NAT cost has two parts: time the gateway exists, and traffic it translates. Most surprises are traffic. Related: egress cost planning and unexpected cost spike.

Symptoms

The NAT, NAT Gateway or Cloud NAT meter moved on the bill. CloudWatch or Azure Monitor shows rising processed-bytes (BytesOutToDestination on AWS). Private-subnet workloads reach public registries, object storage or another region’s public API through the NAT. A new NAT appears in a VPC that already had one. Packet drops are a capacity symptom; check bytes and gateway count first.

Business impact

NAT data processing is billed on volume. A backup, image pull or cross-region copy through a NAT can dominate the networking line. Extra NATs add hourly charges while they exist, including idle test leftovers. Cutting the only NAT takes private subnets off the internet.

Immediate checks

  1. Identify the VPC, VNet or Cloud Router that owns the NAT.
  2. Count NAT resources and public IPs. One extra NAT per AZ is a common design; two extra unused NATs are a cost leak.
  3. Pull processed-bytes and connection-count metrics for the cost window.
  4. Ask what started in that window: image builds, database exports, telemetry agents, or a workload that lost its private endpoint and fell back to the public API.
  5. Confirm the cost meter is NAT data processing or NAT gateway hours, not generic “data transfer.” Those are different lines.

Provider commands and console paths

AWS. VPC console, NAT gateways. CloudWatch metrics are documented under NAT gateway metrics (BytesOutToDestination, BytesInFromSource, ActiveConnectionCount).

aws ec2 describe-nat-gateways \
  --filter Name=vpc-id,Values=vpc-xxxxxxxx \
  --query 'NatGateways[*].{Id:NatGatewayId,State:State,Subnet:SubnetId,Type:ConnectivityType}'

Cost Explorer: filter Service = EC2-Other or the NAT usage types shown on your bill, group by Usage type. Pricing units are on VPC pricing.

Azure. Portal: NAT gateway resource, Metrics (bytes and packets). Cost analysis: filter Resource type Microsoft.Network/natGateways and the related public IP.

az network nat gateway list --resource-group RG
az network nat gateway show --resource-group RG --name NAT_NAME

See az network nat gateway and NAT Gateway overview.

Google Cloud. VPC network, Cloud NAT. Cloud Monitoring: Cloud NAT metrics for the router.

gcloud compute routers nats list --router=ROUTER --region=REGION
gcloud compute routers nats describe NAT_NAME --router=ROUTER --region=REGION
gcloud compute routers get-nat-mapping-info ROUTER --region=REGION

See Cloud NAT.

Alibaba Cloud. VPC console, NAT Gateway. Billing Management, product name NAT Gateway (instance fee plus CU fee; EIPs bill separately).

aliyun vpc DescribeNatGateways --RegionId cn-hangzhou

RegionId is required on DescribeNatGateways. For traffic graphs use CloudMonitor in the console rather than guessed metric names. Billing items are in NAT Gateway billing.

Interpretation

Gateway-hour or instance-fee increase: more NAT resources, or NATs that were created and never released.

Byte, CU or data-processing increase: more flows through an existing NAT. Typical sources:

  • Object storage or package downloads over the public endpoint from a private subnet.
  • Telemetry, vulnerability scanners or CI runners pulling large artifacts.
  • Cross-AZ or cross-region calls that hairpin through NAT instead of private connectivity.
  • A Kubernetes LoadBalancer or DaemonSet that opened unexpected egress.

If bytes are flat and cost still rose, check pricing-plan changes, a new public IP SKU, or EIP charges sitting next to the NAT.

Safe mitigation

Keep the production NAT. Restore private endpoints, Private Link, Private Service Connect or Alibaba PrivateLink for APIs the workload already uses, then watch bytes fall. Pause the job that is copying data through the NAT. Move image pulls to a same-region registry on a private path. Delete a test NAT only after you confirm production routes do not use it. If you have more NATs than AZs you intended, document route tables first, then remove only the unused gateway.

Risky actions to avoid

Do not delete the only NAT on a production route table to “stop the bill.” Private subnets lose egress immediately.

Do not replace NAT with a fleet of public IPs on each instance. That trades one meter for many and widens the attack surface.

Do not disable NAT logging or flow logs to save a few cents while you are still finding the source.

Do not assume NAT cost is the same as internet egress. They can appear together. Split the meters before you change architecture.

Validation

Processed-bytes should drop in the next metric period. The cost tool shows the lower usage type on the next complete day. Confirm a private-subnet host can still reach what it needs. If you removed a NAT, confirm the route table no longer points at a deleted ID.

Prevention

  1. Write one egress design per landing zone and charge it back as a platform service. Topology: hub-and-spoke networking.
  2. Prefer private endpoints for provider APIs (AWS PrivateLink / gateway endpoints, Azure Private Link, Google Private Service Connect, Alibaba PrivateLink) so object storage and package pulls do not hairpin through NAT.
  3. Tag every NAT gateway with owner and environment.
  4. Alert on processed bytes (and connection count if the product exposes it), not only on the monthly bill.
  5. Inventory NAT gateways quarterly. NAT prices change by region; read the current price list before you add a second one.

Official sources