How a Misrouted S3 Worker Almost Handed a Startup a $30,000 AWS Bill

A startup came within 48 hours of receiving a $30,000 AWS invoice after a worker process fetched millions of small JSON files from S3 through a NAT gateway, which charges for every byte of data it routes. The NAT gateway, sitting between the company's private subnet and the internet, silently metered all traffic without any obvious warning to the engineering team. The fix required no application rewrite — adding a VPC gateway endpoint for S3 rerouted traffic through AWS's private network, eliminating the costly NAT charges entirely. The incident highlights a broader cloud cost trap: small-file workloads at scale generate disproportionate per-request overhead, and cross-AZ or NAT-routed traffic can quietly drain budgets. Engineers are advised to trace the physical path of data traffic before scaling any data-moving workload, since intra-region endpoint-routed traffic is often free while NAT-routed traffic is not.