Where does data transfer cost money in AWS, and how do you design to keep egress costs down?
Show the answer
Say this first
Inbound from the internet is free. You pay for data out to the internet, between regions, between availability zones (in each direction), and for processing through NAT gateways, transit gateways and interface endpoints. I keep chatty traffic inside one AZ where the design allows, send S3 and DynamoDB traffic through free gateway endpoints instead of NAT, and cache or compress what leaves.
Go deeper
The meters that surprise people (us-east-1 list prices, they change, always check)
| Path | Charge |
|---|---|
| Internet egress | Roughly 0.09 USD per GB for the first tier, cheaper at volume |
| Between AZs in a region | About 0.01 USD per GB out of one AZ and 0.01 USD per GB into the other |
| NAT gateway | About 0.045 USD per hour plus about 0.045 USD per GB processed |
| Transit gateway | Per attachment per hour plus about 0.02 USD per GB processed |
| Between regions | Charged per GB, varies by region pair |
Design habits
- Gateway endpoints for S3 and DynamoDB. They are route table entries, free, and remove that traffic from the NAT gateway. A backup job pushing terabytes to S3 through NAT is a classic bill shock.
- NAT gateway per AZ. Besides resilience, it avoids paying inter-AZ charges on every outbound byte.
- AZ affinity. Keep app-to-cache and app-to-database traffic in the same AZ when the service supports it; replicate across AZs on purpose, not by accident.
- CDN in front of public content. CloudFront or another CDN offloads repeated downloads.
- Direct Connect for heavy hybrid traffic. Data transfer out over Direct Connect is billed at a lower rate than internet egress.
- Measure. VPC Flow Logs plus Cost Explorer by usage type (
DataTransfer-Regional-Bytes,NatGateway-Bytes) shows who is moving data.
Other clouds
Azure and GCP follow the same shape: free ingress, paid internet and inter-region egress. GCP also charges for traffic between zones in a region.
They will ask next
Is traffic over VPC peering free?
Inside one AZ it is free. Across AZs it carries the normal inter-AZ charge, and inter-region peering is charged as inter-region transfer. Peering has no hourly fee, unlike a transit gateway.
How would you find which workload drives the NAT gateway bill?
Enable flow logs on the NAT gateway's ENI and aggregate bytes by source address, or use CloudWatch
BytesOutToDestinationon the NAT gateway with flow logs to split it per instance.
Traps
- Saying all traffic inside a region is free. Cross-AZ traffic is not.
- Quoting exact prices as permanent facts. Give the shape and say you would check the current price list.