The NAT Gateway bill
Instances in a private subnet read from S3 and pull ECR images through the NAT Gateway, which bills $0.05 per GB in Paris. Cost Explorer and flow logs to find who is sending it, the free S3 gateway endpoint, the interface endpoint break-even, and a calculator to compare three setups.