The NAT Gateway 'Trick' That Was Actually Billing You for ECR, Not S3

A client’s NAT Gateway bill hit a record ~$3,000/month. VPC Flow Logs pointed straight at S3 — except the client swore they barely used S3. Here’s what was actually going on. Hi everyone 👋 A client came to us about a month after going live with a new system built by a different vendor — one they no longer had a maintenance contract with. Their first full invoice after launch showed a NAT Gateway bill at a record high, roughly $3,000/month. Standard architecture on their end: ECS services running in private subnets for security, NAT Gateway for outbound access. Textbook setup on paper — which made a bill that high, right out of the gate, more confusing, not less.