A missing VPC Gateway Endpoint sent EC2-to-S3 traffic through a NAT Gateway, lighting up over $1,000 in unnecessary data processing charges. All that for in-region traffic hitting an AWS service.
Why? AWS defaulted the route to the NAT Gateway. It only takes the free S3 Gateway Endpoint if you tell it to.
The lesson: Cloud networks aren’t simple. If you don’t shape the traffic, AWS will - expensively.
