After creating a VPC and placing instances in private subnets, a new question immediately arises: "How does this instance communicate with the outside world?" The first trap is that there's not one answer but three. Depending on where traffic goes, you must choose between NAT Gateway, VPC Endpoint, or PrivateLink. Choosing wrong results in 10x costs or weakened security.
The most common shock to operators' bills is NAT Gateway data processing charges. $0.045/GB seems modest, but in an ETL environment sending 1TB daily to S3, NAT GW alone costs $1,350 monthly. The same traffic diverted to Gateway Endpoint costs $0. Knowing just this one fact solves 30% of SOA exam scenarios