...
In most cases, the EC2 charge you are seeing is a result of the standard configuration we use in your VPC. The private subnets in your Cornell standard VPC are connected to the world (for outgoing traffic) by a NAT instance. That NAT instance is really a small EC2 instance, though it won't appear in your EC2 instance list in the AWS Console. You can see the NAT instance(s) configured for your account here: https://console.aws.amazon.com/vpc/home?region=us-east-1#NatGateways:sort=desc:createTime
The NAT instance gives other EC2 instances in your private subnets access to the world for things like Linux repos, Windows update servers. We do have some AWS account owners that do not find the $1/day cost of the NAT to be worthwhile and turn it off. However, we caution about this because, with it off, your instances will not be able to do something as basic and critical as running "yum update" or "apt-get update" or get Windows updates.
...