Tasks in private subnets upload terabytes to S3 each month through a NAT gateway, and the NAT data processing charge is high. What is the most direct fix?

Add an S3 gateway VPC endpoint and link it to the private subnets' route tables. The endpoint adds a route, so S3 traffic stays on the AWS network and skips the NAT gateway. Gateway endpoints have no hourly charge and no data processing charge.

"Move the tasks to public subnets with public IPs" would also skip the NAT gateway. But it exposes the tasks to the internet for no good reason.

DynamoDB has the same kind of gateway endpoint.