VPC on The David Page

The NAT Gateway 'Trick' That Was Actually Billing You for ECR, Not S3

Thu, 18 Jun 2026 09:00:00 +0700

A client’s NAT Gateway bill hit a record ~$3,000/month. VPC Flow Logs pointed straight at S3 — except the client swore they barely used S3. Here’s what was actually going on.

Hi everyone 👋

A client came to us about a month after going live with a new system built by a different vendor — one they no longer had a maintenance contract with. Their first full invoice after launch showed a NAT Gateway bill at a record high, roughly $3,000/month. Standard architecture on their end: ECS services running in private subnets for security, NAT Gateway for outbound access. Textbook setup on paper — which made a bill that high, right out of the gate, more confusing, not less.

The MTU 9001 Trap: Flaky Connections Over VPC Peering and VPN

Fri, 20 Feb 2026 09:00:00 +0700

Ping works. SSH works. But the moment the app sends a large payload over VPN or cross-region peering, it just… hangs. This is why.

Hi everyone 👋

This is a classic debugging trap that can burn a new DevOps engineer several days, precisely because the system never throws a clear error log.

😱 The confusing symptom

Two EC2 instances in different VPCs, connected over VPC peering, VPN, or Direct Connect. Ping between them responds fine. SSH works fine too. But the moment the application transfers a large file, or sends a long JSON payload over an API call on that same connection, the request hangs indefinitely until it eventually times out.

The Hidden Cost of Cross-AZ Data Transfer on AWS

Wed, 14 Jan 2026 09:00:00 +0700

Multi-AZ for high availability quietly turned into a network bill bigger than the compute bill — here’s why.

Hi everyone 👋

This is one of those “hidden landmines” on AWS: things that never throw a clear error, never show up in a StackOverflow top answer, but can quietly make a system flaky or burn thousands of dollars a month. First up: cross-AZ data transfer.

😱 The assumption that gets everyone

Everyone knows data transfer out to the internet costs money. Far fewer people realize that traffic between Availability Zones inside the same Region isn’t free either — a lot of us assume “it’s all internal, so it’s free.”