Direct answer: using verifiable official prices retrieved on 8 November 2026 (AWS us-east-1 / Azure Global / Google Cloud public prices, USD, pay-as-you-go, excluding tax and discounts), a private endpoint (AWS PrivateLink, Azure Private Endpoint, Google Cloud Private Service Connect) is typically USD 0.01/hour per endpoint + USD 0.01/GB (GCP charges 0.01/GiB), while a NAT gateway is typically USD 0.045/hour + USD 0.045/GB. With one endpoint and 1TB/month, the private endpoint costs about USD 17/month versus about USD 83/month for NAT (including one public IP); at 10TB, about 110 vs 497/month; at 100TB, about 1,031 vs 4,645/month. But a private endpoint cannot replace all NAT traffic: it only covers supported cloud services/APIs (object storage, databases, SaaS, Google APIs, etc.); internet access still needs NAT/an egress gateway. The right design is to move same-cloud service traffic to private endpoints and leave internet access on NAT.
This guide is for cloud networking, FinOps, platform architecture and security teams comparing private endpoints and NAT gateways on pay-as-you-go cost, applicability and 1/10/100TB TCO. Prices come from the AWS PrivateLink pricing page, the Azure Private Link pricing page and Azure Retail Prices API, the Google Cloud VPC pricing page (Private Service Connect) and the AWS VPC (NAT Gateway) pricing page (all accessed 8 November 2026). Official price facts, editorial calculations and excluded items are kept separate.
(1) A private endpoint's processing fee is about one-quarter of NAT's (0.01 vs 0.045), and its hourly fee is lower too (0.01 vs 0.045); same-cloud service traffic is usually cheaper through a private endpoint. (2) Private endpoints cover supported services only; internet access, unsupported services and cross-cloud/on-premises traffic still need NAT or another egress. (3) AWS interface endpoints are priced per AZ, so three AZs means three endpoint hourly fees; Azure/GCP have different resource models, so do not simply multiply by three.
Scope: private endpoint vs NAT, billing items
A private endpoint bill usually has an endpoint hourly fee and a data processing fee; a NAT gateway bill has a gateway hourly fee, a data processing fee and a public IP hourly fee. The three providers' private endpoint prices are close: AWS PrivateLink interface endpoint USD 0.01/hour/AZ and USD 0.01/GB (first 1PB); Azure Private Endpoint USD 0.01/hour and USD 0.01/GB (first 1PB); GCP Private Service Connect endpoint USD 0.01/hour and USD 0.01/GiB (first 1PB). NAT is USD 0.045/hour + USD 0.045/GB (AWS/Azure); GCP prices the hourly fee by VM and charges USD 0.045/GiB. This article converts 1TB = 1,000GB = 931.32GiB for GCP processing.
| Billing item | Private endpoint | NAT gateway |
|---|---|---|
| Hourly fee | AWS 0.01/endpoint/AZ; Azure 0.01/endpoint; GCP 0.01/endpoint | AWS/Azure 0.045/hour; GCP 0.0014/VM-hour up to 32 VMs, 0.044/hour above 32 |
| Data processing | 0.01/GB (GCP 0.01/GiB), first 1PB; then 0.006, 0.004 | 0.045/GB (GCP 0.045/GiB) |
| Public IP | Not required (private IP) | 0.005/hour per address (AWS/Azure/GCP) |
| Traffic covered | Supported cloud services/APIs, published services | Internet, unsupported services, cross-cloud/on-premises egress |
| Security | No public exposure; private IP/endpoint policies | Requires NAT/firewall/public egress control |
Sources: AWS PrivateLink pricing page, Azure Private Link pricing page and Azure Retail Prices API (Virtual Network Private Link, Global), Google Cloud VPC pricing page (Private Service Connect) and AWS VPC pricing page (NAT Gateway) (accessed 8 November 2026). Rates are retail/pay-as-you-go and exclude tax, discounts, cross-region/egress and logging; the invoice governs.
TCO: one endpoint, 1TB/10TB/100TB
Assume one endpoint, 730 hours/month and 1/10/100TB: the private endpoint hourly fee is USD 7.30/month; processing is USD 0.01/GB (GCP 0.01/GiB); NAT is USD 32.85/month hourly, USD 0.045/GB processing, plus USD 3.65/month for one public IP. The result: at 1TB, the private endpoint is about USD 17.30/month (GCP 16.61) versus NAT about USD 82.58/month (GCP 55.78); at 10TB, about 109.70 vs 497.30 (GCP 100.43 vs 432.96); at 100TB, about 1,031.30 vs 4,644.50 (GCP 938.62 vs 4,204.81). The 0.01 vs 0.045 processing gap dominates as volume grows.
| Monthly volume | Private endpoint (AWS/Azure) | NAT (AWS/Azure) | Private endpoint (GCP) | NAT (GCP, 10 VMs) |
|---|---|---|---|---|
| 1TB | about 17.30 | about 82.58 | about 16.61 | about 55.78 |
| 10TB | about 109.70 | about 497.30 | about 100.43 | about 432.96 |
| 100TB | about 1,031.30 | about 4,644.50 | about 938.62 | about 4,204.81 |
Editorial calculation: private endpoint = 0.01 x 730 + GB x 0.01 (GCP uses 931.32GiB/TB); NAT = 0.045 x 730 + GB x 0.045 + 1 x 0.005 x 730 (GCP uses 10-VM hourly fee + 931.32GiB/TB). Excludes cross-region/egress, logging, tax, discounts and multiple endpoints; the invoice governs.
Multi-AZ and units: AWS per AZ, Azure/GCP per endpoint/region
AWS PrivateLink interface endpoints are deployed and priced per Availability Zone: for 3-AZ high availability you usually need three endpoints, so the hourly fee rises from USD 7.30/month to USD 21.90/month; data processing is still billed on total volume. Azure Private Endpoint is priced per endpoint (0.01/hour), and GCP Private Service Connect endpoint is per endpoint (0.01/hour), but the HA design depends on the service/region. With three AWS endpoints at 1TB: 21.90 + 10 = USD 31.90/month, still below NAT's 82.58; at 10TB, 124.30 vs 497.30; at 100TB, 1,045.90 vs 4,644.50. Even with three AZs, private endpoints retain a clear cost advantage.
| Option | 1TB | 10TB | 100TB | Note |
|---|---|---|---|---|
| AWS PrivateLink x1 AZ | 17.30 | 109.70 | 1,031.30 | One endpoint |
| AWS PrivateLink x3 AZ | 31.90 | 124.30 | 1,045.90 | Three endpoint hourly fees |
| Azure Private Endpoint | 17.30 | 109.70 | 1,031.30 | Per endpoint |
| GCP PSC | 16.61 | 100.43 | 938.62 | Per endpoint/GiB |
| NAT (AWS/Azure) | 82.58 | 497.30 | 4,644.50 | Includes one public IP |
Editorial calculation: AWS 3 AZ = 3 x 0.01 x 730 + processing; Azure/GCP one endpoint; NAT = 0.045/hour + 0.045/GB + one IP. Excludes cross-region/egress, logging, tax and discounts; GCP uses 931.32GiB/TB.
Applicability: a private endpoint cannot replace all NAT
Private endpoints are suitable for supported cloud services (object storage, databases, message queues, SaaS, Google APIs, etc.) or published services; they keep traffic on the cloud private network with private IPs and usually avoid public IP/NAT. They are not suitable for general internet access, unsupported services, cross-cloud/on-premises egress or scenarios requiring a fixed public egress IP. NAT remains necessary for patches/updates, external APIs, third-party services and cross-cloud/on-premises connectivity. The right architecture is "private where possible, NAT where necessary", not an either/or choice.
| Traffic | Private endpoint | NAT | Recommendation |
|---|---|---|---|
| Same-cloud object storage/database | Supported | Works but more expensive | Prefer private endpoint |
| Cloud APIs (e.g. Google APIs) | Supported (PSC) | Works | Prefer private endpoint |
| Third-party SaaS/external APIs | Depends on support | Usually required | NAT/egress gateway |
| Public downloads/patches | Not applicable | Required | NAT/egress |
| Cross-cloud/on-premises | Depends on interconnect | May be required | VPN/dedicated link/egress |
| Fixed public egress IP | Not applicable | Required | NAT + EIP |
Editorial synthesis; supported services, regions and endpoint types follow AWS/Azure/GCP official documentation. Cross-region/egress fees and interconnect options are not listed.
How to choose: by traffic type, AZ requirements and security boundary
Start with a traffic map: which traffic goes to same-cloud storage/databases/APIs, which goes to the internet, which crosses clouds/on-premises, whether a fixed egress IP is required, and whether multi-AZ is needed. For heavy same-cloud service traffic, the private endpoint's 0.01 processing fee is usually cheaper than NAT's 0.045 and reduces public exposure; keep NAT for internet/unsupported traffic; include AWS endpoint count for multi-AZ; if the endpoint hourly fee is high relative to very small traffic, NAT's simplicity may matter more. Build a blended estimate based on the share of traffic a private endpoint can cover, rather than a full replacement.
| Scenario | Prefer | Check first |
|---|---|---|
| Heavy same-cloud storage/database access | Private endpoint | Service support, endpoint AZ count |
| Internet/third-party APIs | NAT/egress gateway | Egress IP, bandwidth, firewall |
| Multi-AZ high availability | Private endpoint + NAT mix | AWS endpoint count, Azure/GCP model |
| Small traffic, few services | NAT (simpler) | Endpoint hourly share |
| Strong security/private IP requirement | Private endpoint | Endpoint policies, DNS, audit |
Editorial selection framework, not a vendor recommendation; validate against service support, network architecture, security requirements and actual invoices.
90-day implementation checklist
Use the first 90 days to connect the traffic map, private-endpoint coverage, endpoint/AZ design, DNS/routing and cost comparison. The order is: traffic map, supported-service list, pilot, cost comparison, migration, monitoring.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Map traffic: same-cloud services/internet/cross-cloud/on-premises | Traffic classes, NAT bill baseline |
| Weeks 2-3 | Confirm which services support private endpoints/PSC | Support list, gaps |
| Weeks 3-5 | Pilot one or two high-volume services | Pilot architecture, DNS/routing plan |
| Weeks 5-7 | Compare private endpoint vs NAT over 1/3 years | Cost comparison, migration priority |
| Weeks 7-9 | Migrate same-cloud traffic; keep public NAT | Migration record, rollback plan |
| Weeks 9-11 | Set alerts for endpoints/processing/public IPs | Dashboard, alert rules |
| Weeks 11-12 | Review savings, availability and security | Savings report, next-round plan |
Editorial implementation advice, not an official template; architecture, service support, security and compliance follow enterprise standards and vendor documentation.
FAQ
Can a private endpoint fully replace NAT?
No. Private endpoints only cover supported cloud services/APIs or published services; internet access, unsupported services, cross-cloud/on-premises egress and scenarios requiring a fixed public egress IP still need NAT/an egress gateway. Use a mix: private where possible, NAT where necessary.
How big is the price difference?
A private endpoint is typically 0.01/hour + 0.01/GB; NAT is 0.045/hour + 0.045/GB. At 1TB, about 17 vs 83 USD/month; at 10TB, about 110 vs 497; at 100TB, about 1,031 vs 4,645. The gap comes mainly from processing (about 4.5x) and NAT's public IP fee.
Why is a private endpoint cheaper?
Because its processing fee is 0.01/GB versus NAT's 0.045/GB, and it does not need a public IP (NAT charges 0.005/hour per address). But it has an endpoint hourly fee, which matters more at small volumes.
How is multi-AZ priced?
AWS PrivateLink interface endpoints are priced per AZ; three AZs usually means three endpoint hourly fees. Azure Private Endpoint is per endpoint; GCP PSC is per endpoint. Even with three AWS AZs, 1TB is about USD 32/month, still below NAT's 83.
Which services are supported?
AWS PrivateLink supports S3, DynamoDB, EC2, API Gateway and third-party services; Azure Private Link supports Azure Storage, SQL, Cosmos DB, Key Vault and others; GCP PSC supports Google APIs and published services. Check each provider's official support list.
Are there still egress fees through a private endpoint?
The private endpoint price is a private-connectivity premium; data transfer/cross-region/egress fees may still apply. Cross-region access, cross-cloud/on-premises interconnect and internet egress can add costs; include them in the TCO.
What are the security benefits?
Private endpoints use private IPs and avoid public exposure, reducing the attack surface; with endpoint policies, DNS, security groups/NSGs and audit, it is easier to control who can access which service. It is not a replacement for a firewall.
When should we keep NAT?
For internet access, unsupported services, cross-cloud/on-premises egress, fixed public IP requirements, or very small traffic where the endpoint hourly fee is not justified. Use a blended design based on traffic share, not a full replacement.
Research method and limitations
This article separates "official price facts" from "editorial calculations": AWS PrivateLink USD 0.01/hour/AZ and USD 0.01/GB (first 1PB) come from the AWS PrivateLink pricing page; Azure Private Endpoint USD 0.01/hour and USD 0.01/GB come from the Azure Private Link pricing page and Azure Retail Prices API (Virtual Network Private Link, Global); GCP PSC USD 0.01/hour and USD 0.01/GiB come from the Google Cloud VPC pricing page; NAT USD 0.045/hour + USD 0.045/GB and public IP USD 0.005/hour come from the AWS VPC pricing page (for comparison). TCO, unit conversion and the 90-day list are editorial calculations/advice.
Eight limitations: (1) only public pay-as-you-go prices are used, excluding tax, enterprise/commit discounts and support; (2) cross-region/egress, logging, DNS, endpoint policies and interconnect costs are not included; (3) the scenario assumes one endpoint, 730 hours/month and one public IP; (4) GCP bills in GiB and this article converts 1TB to 931.32GiB; (5) no performance/availability testing was performed; (6) prices change and should be re-queried after publication; (7) self-managed PrivateLink alternatives and third-party firewalls are not covered; (8) this is not procurement, commercial or legal advice.
Sources and basis
- AWS, AWS PrivateLink pricing: aws.amazon.com/privatelink/pricing/. Interface endpoint USD 0.01/hour/AZ; data processing USD 0.01/GB (first 1PB), then 0.006/0.004. Accessed 8 November 2026.
- Microsoft, Azure Private Link pricing: azure.microsoft.com/en-us/pricing/details/private-link/. Private Endpoint USD 0.01/hour; data processing USD 0.01/GB (first 1PB), then 0.006/0.004. Accessed 8 November 2026.
- Microsoft, Azure Retail Prices API (Virtual Network Private Link, Global): prices.azure.com/api/retail/prices. Standard Private Endpoint USD 0.01/hour; data processed 0.01/0.006/0.004 per GB. Accessed 8 November 2026.
- Google Cloud, VPC pricing (Private Service Connect): cloud.google.com/vpc/pricing. PSC endpoint USD 0.01/hour; data processing USD 0.01/GiB (first 1PB), then 0.006/0.004. Accessed 8 November 2026.
- AWS, Amazon VPC pricing (NAT Gateway, for comparison): aws.amazon.com/vpc/pricing/. NAT USD 0.045/hour and USD 0.045/GB; public IPv4 USD 0.005/hour. Accessed 8 November 2026.
Data cut-off 8 November 2026; prices and specifications follow AWS/Azure/GCP official pages/APIs and the invoice; not procurement, commercial or legal advice.