I see this in almost every AWS account I audit. The team knows their bill is high. They open Cost Explorer, see "EC2-Other" at the top, and stop there because there is nothing to click on. No instance ID. No resource name. Just a category that means "everything EC2-related that is not the instance hour itself."
Here is what is actually inside that line item and why it matters.
What "EC2-Other" actually contains
EC2-Other is where AWS parks charges that are related to EC2 but are not the compute hour. The big ones:
NAT Gateway. Hourly charge ($0.045/hour, roughly $32/month per gateway just for existing) plus a per-GB data processing fee ($0.045/GB for every byte that passes through it). If you run three NAT Gateways for multi-AZ redundancy, that is $97/month before a single byte moves. If those gateways process 1 TB of data, add another $45.
EBS volumes and snapshots. Volumes keep billing even when instances are stopped. A 100GB gp3 volume costs about $8/month whether you are using it or not. Snapshots add up at $0.05/GB-month. I find orphaned snapshots from 2023 in almost every account.
Elastic IPs. Since February 2024, every public IPv4 address costs $0.005/hour ($3.65/month) whether it is attached to a running instance or not. Before that change, in-use IPs were free. Most teams missed the memo.
Data transfer. Cross-AZ traffic at $0.01/GB each direction. Cross-region at $0.02/GB. These sound small. They are not small when you have a Kubernetes cluster spread across three AZs with 50 services talking to each other. That pattern generates 5-10 TB of inter-AZ traffic per month. At $0.02/GB round trip, that is $100-200/month in pure network charges.
Load balancer charges. ALB and NLB hourly fees plus data processing. These show up under EC2-Other, not under their own service line.
The NAT Gateway problem specifically
NAT Gateway is the single biggest surprise I find inside EC2-Other. The pricing has three layers that stack on top of each other, and most teams only know about the first one.
Layer 1: the hourly charge. $0.045/hour. Always on. $32/month per gateway per AZ. You are paying this right now if a NAT Gateway exists in your account, regardless of traffic.
Layer 2: the data processing charge. $0.045/GB for every byte processed. This is on top of the hourly charge. Send 1 TB through the gateway: $45.
Layer 3: the data transfer charge. If the traffic is going to the internet, you also pay the standard EC2 egress rate: $0.09/GB for the first 10 TB/month. This is on top of layers 1 and 2.
Add them up: internet-bound traffic through a NAT Gateway costs $0.135/GB. That is three times the headline data processing rate. Most teams quote "$0.045 per GB" because that is what the NAT Gateway pricing page emphasizes. The true cost for internet-bound traffic is $0.135.
Now multiply by three AZs.
The fix that costs zero dollars
The single highest-ROI networking optimization in AWS is a VPC Gateway Endpoint for S3 and DynamoDB. It costs nothing. Zero dollars. No hourly charge. No per-GB charge. The traffic goes directly from your VPC to S3 over the AWS private network, bypassing the NAT Gateway entirely.
S3 and DynamoDB traffic typically accounts for 35-45% of NAT Gateway data processing in production accounts. Eliminating that traffic from the NAT path saves $0.045/GB on every byte. At 5 TB/month of S3 traffic, that is $225/month saved. One CloudFormation resource. Zero application changes.
If you have not done this, do it today. It is probably the most money you can save on AWS in under an hour.
For other AWS services (ECR, CloudWatch, SQS, SNS, KMS), Interface VPC Endpoints cost $0.01/GB instead of NAT Gateway's $0.045/GB. The break-even is about 200 GB/month per endpoint. Above that, the endpoint pays for itself.
How to actually find this in your account
Open Cost Explorer. Filter by Service: EC2-Other. Group by Usage Type. Look for these line items:
NatGateway-Hours: the hourly charge. If this is more than $32/month, you have more than one gateway.NatGateway-Bytes: the data processing charge. This is where the volume cost lives.DataTransfer-Regional-Bytes: cross-AZ traffic. If this is large, your route tables need an audit.EBS:VolumeUsageandEBS:SnapshotUsage: storage that is billing whether you know about it or not.
If NatGateway-Bytes is your top usage type inside EC2-Other, the next step is figuring out which traffic is flowing through the gateway. VPC Flow Logs will tell you the source and destination. The most common culprits: S3 traffic that should be going through a Gateway Endpoint, container image pulls from ECR, CloudWatch log shipping, and any external API calls from private subnets.
What Kulshan does with this
When I run Kulshan against a client account, the cost pack traces the full attribution chain automatically. It does not stop at "EC2-Other is high." It breaks down the usage types, identifies the top contributor (usually NAT Gateway), traces it to a specific region and account, and cross-references it against AWS Cost Anomaly Detection to see if AWS itself flagged the same spike.
The output looks like this:
01 EC2-Other spike traced to USE1-NatGateway-Bytes in us-east-1
confirmed by Kulshan and AWS Cost Anomaly Detection
cost · critical · anomaly overlap · high confidence
That is one line in the report. But the investigation behind that line, the one most teams spend half a day on in Cost Explorer, took Kulshan about 30 seconds.
The sample report at missionfinops.com/sample/ shows the exact shape of this output with synthetic data. The format is identical to what a real run produces.
The thing I want you to take from this
EC2-Other is not a cost problem. It is a visibility problem. The money inside it has specific sources, specific causes, and specific fixes. Most of those fixes are configuration changes, not architecture rewrites.
If your team's monthly cost review involves someone screenshotting Cost Explorer and pasting it into Notion, you are stopping one step before the useful part. The screenshot shows you the number. The audit shows you the cause.
That is the difference between a source and an audit. Cost Explorer is the source. What you do with it is the audit.
Back to all posts