GCP Cloud NAT Cost: Gateways, Data, and Egress

Public NAT cost includes the NAT gateway, data processed by the gateway, external IP addresses used by it, and any applicable outbound data transfer. The gateway charge depends on the resources receiving a NAT assignment, so an almost idle fleet can still create gateway and IP costs before it transfers much data.

Private NAT also charges for gateway time and processed data, while traffic through Cloud Interconnect, Cloud VPN, or Network Connectivity Center can add service-specific costs. Keep Public and Private NAT paths separate because their attached resources and downstream transfer charges differ.

For each regional gateway, record monthly active hours, the number of assigned VM instances or other supported resources, inbound and outbound GiB processed, NAT IP count, and destination. Apply the current official Cloud NAT rates to each component, then add internet or hybrid-network transfer instead of treating the per-GiB NAT charge as the entire network bill.

Model normal traffic and a burst case. GKE nodes, batch workers, update downloads, third-party API calls, retries, and large exports can increase connections or bytes even when user-facing request counts look small. Cloud Run and other serverless resources can also use Cloud NAT through supported VPC egress configurations.

Review whether every subnet and resource needs NAT, remove unused gateways and addresses, keep dependent services close when architecture requirements allow, and reduce repeated outbound downloads with caching or artifact mirrors. Size NAT IP allocation for connection demand rather than assuming fewer IPs are always better, because insufficient ports can cause dropped connections.

Use Cloud Monitoring for processed bytes, connections, port usage, allocation errors, and dropped packets. Cloud NAT monitoring itself is not charged, while exported NAT logs use Cloud Logging pricing. Start with error-only logging when it meets operational needs, apply exclusions or retention deliberately, and recalculate after deployments using actual gateway metrics and the current official pricing page.