The S3 endpoint was built, and the NAT bill did not move
A cost review found six terabytes a month of S3 traffic being processed by the NAT gateway and charged for it. An S3 gateway endpoint was created that afternoon, associated with a route table, and the ticket was closed.
The next invoice was the same. The endpoint is real, it is healthy, and parts of this VPC have never sent it a byte.
Tap everything that is still reaching S3 the expensive way.
!A gateway endpoint that costs nothing to run, built specifically to stop a five-figure line item, and a NAT data-processing charge that did not fall by a measurable amount.An endpoint is not used because it exists. It is used by the subnets whose route table it was attached to, for buckets in its own Region.
Boundaries, outermost first: Platform VPC — us-east-1: Route table A (endpoint attached), Route table B (never attached), Batch subnet (uses table B) Outside every boundary: Archive bucket (in eu-west-1), API subnet (uses table A), Primary bucket (in us-east-1) This diagram draws no connections between its components.
Tap every component that is wrong.