Elastic Beanstalk now runs on EKS


⏱️
Reading time: 11 minutes
🎯
Main Learning: Measure NAT traffic first. CI runners rarely need NAT at all.
📝

Hey Reader 👋🏽

NAT Gateways are one of those things you set up once and never look at again (probably!) 😅

Until NatGateway-Bytes shows up near the top of the bill, filed under EC2-Other - thanks AWS! I think they've made this on purpose to hide these significant networking related costs somewhere and made it hard to reflect on!

The hourly fee is predictable, sure. But the per-GB fee grows with every image pull and every npm install, and nobody ever approved it as a cost decision 😬 In the worst case, you're billed 3 times, if the NAT gateway also moves data across zones.

In this issue: where NAT costs come from, why CI runners are the worst case and some nice mitigations to avoid most of the nasty costs 👀

Sponsored by Archera

Your Savings Plan, minus the lock-in

plan.yaml Archera
term: 3y
- exit: none
+ release_guarantee: true
- coverage: what_feels_safe
+ coverage: what_you_run
- managed_by: full_takeover
+ guarantee: the_ones_you_pick
platform_fee: 0
# paid only when you save

Your roadmap changes every quarter. Your Savings Plan doesn't. Archera guarantees it: if plans change, the release guarantee covers you.

Your NAT Gateway Is a Tax on Everything You Download

📚 This Week's Deep Dive

In us-east-1, a NAT Gateway costs $0.045 per hour per availability zone. That's about $33 a month before it processes a single byte. Then it charges another $0.045 for every GB, in both directions.

The second part is the one that gets people. Inbound data from the internet is free on AWS. Send it through a NAT Gateway and you pay for it anyway.

Nobody decides to spend more on NAT. A team adds a CI pipeline, a node pool scales up, a service moves to a bigger base image. None of it looks like a cost decision in code review.

📰 This Week in AWS

🔄EventBridge rebuilt its custom event buses

One bus shared across accounts, with strict ordering and up to a year of retention. Replaces most cross-account forwarding rules. Read More →

⚡Lambda SnapStart works with container images

Container image functions can resume from a snapshot now. Cold starts drop from seconds to under one. Read More →

📨SNS messages can be 1 MiB now

Up to 1 MiB per message, four times the old limit. No more offloading payloads to S3 just to publish them. Read More →

Start with one subnet. Pull NatGateway-Bytes from Cost Explorer, find out where the traffic goes, fix the biggest source, and check again a week later.

Found something odd in your own NAT bill? Hit reply and tell me what it was.

See you next week! 🙏

Tobi & Sandro

​Sandro Volpicella & Tobias Schmidt from AWS Fundamentals​
​
Cloud Engineers • Fullstack Developers • Educators

Manage your email preferences 📨

AWS for the Real World

We teach AWS for the real world - not for certifications. Join more than 10,500 developers learning how to build real-world applications on AWS.

Read more from AWS for the Real World

⏱️ Reading time: 15 minutes 🎯 Main Learning: A public container on AWS for $7 a month, with no VPC to own. 📝 Blog Post 🤝 Sponsored by AWS. What we built, what it cost and what we think of it are our own. Hey Reader 👋🏽 Your first container on ECS comes with homework: a VPC, subnets in two Availability Zones, a load balancer, security groups, a certificate and a task role. Express Mode creates most of it for you now (App Runner's successor, so ECS abstraction number three), but it all lands in...

AWS FOR THE REAL WORLD ⏱️ Reading time: 6 minutes 🎯 Main Learning: You cannot skip a level of AWS observability. Structured logs come first, then the AI agent that reads them for you. 📝 Blog Post 📂 Claude Code agent (free gist) 🎬 Watch on YouTube Hey Reader 👋🏽 This week I'm bringing back one of our most-read posts: the 3 levels of AWS observability. A lot of you joined after it went out in May, and the topic fits this week perfectly. Because the real question isn't "do I have logs?" anymore....

AWS FOR THE REAL WORLD ⏱️ Reading time: 10 minutes 🎯 Main Learning: Every convenience layer AWS built on ECS is dead or dying, while ECS itself has not changed since 2014. Build on the primitive, and make the layer above it prove itself first. 📝 Blog Post Hey Reader 👋🏽 Getting started with an AWS service often feels more complicated than it should. Four concepts must be understood before a single container runs. A VPC is required before a single request. So, the fancy CLI that promises to do...