How to reduce high NAT gateway costs for EC2 workloads using S3 and DynamoDB?

A company is replatforming a legacy data processing solution to AWS. The company deploys the solution on Amazon EC2 Instances in private subnets that are in one VPC. The solution uses Amazon S3 for abject storage. Both the data that the solution processes and the data the solution produces are stored in Amazon S3. The solution uses Amazon DynamoDB to save its own state. The company collects flow logs for the VPC. The solution uses one NAT gateway to register its license through the internet. A software vendor provides a specific hostname so the solution can register its license. The company notices that the AWS bill exceeds the projected budget for the solution. A network engineer uses AWS Cost Explorer to investigate the bill. The network engineer notices that the USE2-NatGateway-Bytes($) usage type is the root cause of the higher than expected bill. What should the network engineer do to resolve the issue? (Choose two.)

Set up Amazon VPC Traffic Mirroring. Analyze the traffic to identify the traffic that the NAT gateway processes.
Examine the VPC flow logs to identity the traffic that traverses the NAT gateway. Source Reference Answer
Set up an AWS Cost and Usage Report in the AWS Billing and Cost Management console. Examine the report to find more details about the NAT gateway charges.
Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IP addresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges for Amazon S3 and DynamoDB.
Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up and associated with the route tables of the private subnets. Source Reference Answer

Community Votes

100%

100% of anonymous learners picked answer BE. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests your understanding of NAT gateway data processing costs and the role of gateway VPC endpoints in keeping AWS service traffic off the internet-facing path. The common trap is confusing traffic inspection or restrictive security groups with the actual solution: routing S3 and DynamoDB traffic through VPC endpoints.

This question focuses on diagnosing unexpectedly high AWS NAT gateway charges caused by private EC2 instances sending traffic to S3 and DynamoDB through the NAT gateway. The community consensus is to examine VPC Flow Logs to identify the traffic and to verify that gateway VPC endpoints for S3 and DynamoDB are configured and associated with the private subnet route tables.

The most common wrong answers are C (using AWS Cost and Usage Report) and D (restricting security groups). Candidates pick C because they think more billing detail will reveal the cause, but it does not provide per-flow traffic details. Candidates pick D because they think blocking traffic helps, but it fails to solve the root cause: S3 and DynamoDB traffic still traverses the NAT gateway.

Community Discussion (10 comments)

AzureDP900 👍 1 Selected: BE

B. Examine the VPC flow logs to identify the traffic that traverses the NAT gateway. This can provide insight into what's being processed by the NAT gateway, which may be contributing to the higher-than-expected bill. E. Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up and associated with the route tables of the private subnets. This will help ensure that data from these services can be accessed through the VPC without using the NAT gateway, which is likely to save on costs. By analyzing the VPC flow logs and verifying the setup of gateway VPC endpoints for Amazon S3 and DynamoDB, the network engineer can gain a better understanding of the traffic patterns and take steps to optimize usage of the NAT gateway.

woorkim 👍 1

B,E is answer! B. Examine the VPC flow logs to identify the traffic that traverses the NAT gateway. VPC flow logs provide detailed information about the traffic that flows through the NAT gateway. By analyzing these logs, the network engineer can identify which traffic is unnecessarily routed through the NAT gateway and contributing to the high costs. E. Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up and associated with the route tables of the private subnets. NAT gateway costs increase because traffic to Amazon S3 and DynamoDB is traversing the NAT gateway instead of using gateway VPC endpoints. Setting up gateway endpoints for these services ensures that traffic stays within the AWS network, eliminating NAT gateway charges for these services.

Spaurito 👍 1

BE - are correct A - Traffic mirroring not needed and added cost B - Allows to review traffic for the NAT GW C - Cost and Billing Reports will help but not specific traffic details D - Lots of Overhead - This could work but not necessary. E - Verify the S3 and DynamoDB endpoints are configured properly.

VerRi 👍 2 Selected: BE

B. Investigation D. It restricts traffic to the gateway endpoint and the NAT gateway, but it does not provide info about the traffic E. Ensure to use the internal traffic

AlirezaNetWorld 👍 2

DE are the right answers.

qomtodie 👍 1 Selected: BE

nerver D

cas_tori 👍 1 Selected: BE

this is BE

Cacheirez 👍 4 Selected: BE

VPC flow logs will help you identify the specific traffic that is being routed through the NAT gateway. This is crucial for understanding which parts of your architecture are causing the excessive NAT gateway usage. By analyzing these logs, you can pinpoint whether traffic to services like Amazon S3, DynamoDB, or other external services is responsible for the high costs. VPC endpoints (specifically gateway endpoints for S3 and DynamoDB) allow traffic between your VPC and these AWS services to bypass the NAT gateway, thus reducing the data transfer costs associated with the NAT gateway. Ensuring that these endpoints are correctly configured and associated with the route tables of your private subnets will ensure that traffic to S3 and DynamoDB does not unnecessarily traverse the NAT gateway.

komorebi 👍 1 Selected: BD

Answer is BD

jhon648274 👍 2

BE Endpoints can be used to access the s3 and dynamodb services at a reduced cost - avoids using nat gateway S3 vpc endpoint gateway is free

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Understanding the Problem

A NAT gateway incurs two types of charges: an hourly hourly rate and a per-GB data processing fee for all traffic that passes through it. When EC2 instances in private subnets need to reach Amazon S3 or DynamoDB, the default route is often via a NAT gateway. This means every API call and data transfer to/from S3 and DynamoDB is charged as NAT gateway processing. Since the company stores both input and output data in S3 and uses DynamoDB for state, the volume of traffic can be very large, causing the bill to exceed the budget.

Correct Answer: B and E

Option B — Examine VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in the VPC, including the NAT gateway's elastic network interface. By querying the flow logs, the network engineer can identify which destinations consume the most bytes and which traffic flows through the NAT gateway. This helps confirm whether S3 and DynamoDB traffic is using the NAT gateway and provides the data needed to justify the next step.

Option E — Verify gateway VPC endpoints for S3 and DynamoDB. Amazon S3 and DynamoDB both support gateway VPC endpoints (type Gateway). These endpoints are free and allow private subnets to access S3 and DynamoDB without leaving the AWS network, eliminating NAT data processing costs. A gateway endpoint works by adding a route to the VPC route table, directed to a prefix list (e.g., pl-xxxx). Simply creating the endpoint is not enough; it must be associated with the route tables of the private subnets. If it is correctly configured, traffic destined to S3 and DynamoDB will use the endpoint instead of the NAT gateway, significantly reducing charges.

Why Other Options Are Incorrect

Option A — VPC Traffic Mirroring is not a cost investigation tool. It copies live traffic from network interfaces to a monitoring appliance, adding complexity and cost. It might show traffic content, but flow logs already provide the metadata needed to identify the traffic source, destination, and byte counts.

Option C — Cost and Usage Report helps break down charges by usage type but does not show the actual network flows inside the VPC. It can confirm that NAT gateway charges are high, but it cannot tell you which IP addresses or services are generating the traffic. Flow logs are the correct tool for that.

Option D — Security group changes could potentially reduce unwanted traffic, but the core problem is that legitimate traffic to S3 and DynamoDB is traversing the NAT gateway. Restricting outbound traffic to only specific IP addresses does not resolve the cost issue; it could even break the license activation or other required traffic. The correct fix is to route AWS service traffic through VPC endpoints, not to block it.

Community Insights

Most community voters selected BE, with comments explaining that flow logs reveal traffic details and gateway endpoints reduce cost. One commenter specifically noted that "Cost and Billing Reports will help but not specific traffic details." Another correctly pointed out that traffic mirroring is not needed and adds cost. The consensus is clear: identify the traffic via flow logs, then eliminate NAT gateway usage for S3 and DynamoDB by using gateway endpoints.

Official Reference

Exam Strategy

When you see a NAT gateway cost problem, immediately think of two steps: inspect the actual traffic using VPC Flow Logs and remove AWS service traffic from the NAT path using VPC endpoints. Remember that gateway VPC endpoints are free and are the correct fix for S3 and DynamoDB, while interface endpoints are for other services. Avoid picking options that merely describe more billing tools or security group hardening, as they do not address the root cause.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide