AWS vpc: Document metering policy behavior with 1:1 NAT

Service: vpc · 2026-10-23 · Documentation low

File: vpc/latest/tgw/metering-policy.md

Summary

Adds a section explaining how enabling 1:1 NAT changes which metering policy CIDR conditions match (source/destination conditions match translated NAT addresses), and gives a recommended order of operations for updating metering policies before enabling NAT.

Security assessment

The added content is purely about cost allocation/billing behavior when NAT translation changes which CIDR conditions match. It describes billing outcomes and policy update sequencing, with no authentication, encryption, or vulnerability content.

Evidence

+If you use metering policies for flexible cost allocation, enabling 1:1 NAT changes which policy rules match your traffic. Metering policies match traffic by the addresses it has inside the transit gateway:

Diff

diff --git a/vpc/latest/tgw/metering-policy.md b/vpc/latest/tgw/metering-policy.md
index e459945..15e9c82 100644
--- a//vpc/latest/tgw/metering-policy.md
+++ b//vpc/latest/tgw/metering-policy.md
@@ -181,0 +182,34 @@ Metering policies are supported for both IPv4 and IPv6 traffic. CIDR block match
+#### Metering policies and 1:1 NAT
+
+If you use metering policies for flexible cost allocation, enabling 1:1 NAT changes which policy rules match your traffic. Metering policies match traffic by the addresses it has inside the transit gateway:
+
+  * **Source CIDR conditions** match the translated (NAT) source address, for traffic from an attachment whose source is translated.
+
+  * **Destination CIDR conditions** match the destination's NAT address, for traffic sent to an attachment with NAT rules.
+
+
+
+
+Rules that use only attachment, attachment type, protocol, or port conditions aren't affected.
+
+A rule whose CIDR conditions use an attachment's original (pre-NAT) CIDRs no longer matches that attachment's translated traffic. That traffic is then billed according to the next matching rule, usually your policy's default rule.
+
+**Update your metering policy before you enable NAT**
+
+Metering policy changes can take up to 2 hours to take effect. To keep cost allocation consistent:
+
+  1. Add metering policy rules that use the NAT CIDRs, alongside your existing rules. These rules match nothing until NAT is enabled.
+
+  2. Wait for the policy change to take effect.
+
+  3. Enable NAT on the attachment.
+
+  4. After NAT is enabled, remove the rules for the original CIDRs that no longer match any traffic.
+
+
+
+
+If you enable NAT first and update your policy afterward, translated traffic is billed according to the next rule in your policy that matches it, which might be the default rule, until the policy update takes effect.
+
+For more information about 1:1 NAT, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html).
+