Most of a private subnet's NAT gateway bill is traffic to Amazon S3. The instances must keep using private addresses. What removes that S3 traffic from the NAT gateway?
Select an answer to reveal the explanation.
Short Explanation
S3 does not need to walk through the NAT gateway. You add a gateway endpoint and a route to the prefix list so that traffic stays on the AWS network. A second NAT gateway is another toll booth on the same road.
Full Explanation
A gateway endpoint for S3 adds a prefix-list route and keeps bucket traffic off the NAT gateway, which cuts the data-processing charge that dominates this bill. Instances keep their private addresses. Another NAT gateway still processes the bytes. Public addresses abandon the private design. A lifecycle rule changes storage class, not the network path or the NAT price. Caveat: the endpoint policy and the route table associated with these subnets both have to cover the buckets, or some calls still hairpin through NAT. Operational check: after the route is in place, NAT bytes should drop for S3 while S3 requests from the private instances still succeed. Create the gateway endpoint in the VPC and add the prefix-list route to each private route table that should stop using NAT for S3. Leave the NAT gateway for everything that is not S3. The endpoint policy should allow the buckets the instances use. Compare NAT bytes and S3 request metrics the next day; S3 success with falling NAT bytes is the proof. A second NAT gateway cannot take S3 off the bill.