Networking Costs

By the end of this lesson you will be able to

• Say which network traffic AWS charges for and which it does not: in from the internet, inside one AZ, across AZs, to a public IP, across Regions, out to the internet and out over Direct Connect.
• Work out a monthly data transfer bill from per-GB prices, including the “each direction” rule for cross-AZ traffic and the tiered internet egress price.
• Compare a NAT gateway, a gateway endpoint and an interface endpoint for the same traffic, and spot the cross-AZ NAT trap.
• Compare the cost of VPC peering and Transit Gateway for traffic between VPCs.
• Cut egress with CloudFront, by moving compute next to the data, and with Direct Connect, and know what S3 Transfer Acceleration and cross-Region replication add.
• Read a cost question on the exam, pick the cheapest design that still meets the availability requirement, and use the chapter 22 cheat sheet to pick the right connectivity option.

#Why the network has its own line on the bill

Most people price a design by its servers and storage. Then the first real bill arrives and a line called data transfer, or NAT gateway, is one of the biggest on it. Network charges are small per gigabyte, but they apply to every gigabyte, in designs that move terabytes without anyone noticing: a busy app talking to a database in another AZ, a batch job pulling from S3 through a NAT gateway, a video served straight from a bucket.

The owner’s notes touch costs only in passing: cross-AZ NAT traffic costs extra (lesson 3.4), Elastic IPs are billed (lesson 3.6), a gateway endpoint is free while an interface endpoint is paid (lesson 22.2), and VPN is cheaper than Direct Connect to start (lessons 22.4 and 22.5). This lesson puts all of it on one map, with the numbers, so you can price a design before you build it.

#The price map

The diagram below is the whole lesson in one picture. Each arrow is a kind of traffic; each badge is what one gigabyte on that arrow costs.

#Free: the directions that cost nothing

• In from the internet. Uploads, requests and anything else arriving from the internet are free, in every Region.
• Inside one AZ, on private IPs. Two instances in the same AZ talking over their private addresses pay nothing, however much they send.
• Between EC2 and S3, DynamoDB, SQS and other Regional services in the same Region. You pay the service for requests and storage, not for the transfer. (Through a NAT gateway, the NAT processing fee still applies: see below.)
• From an AWS origin (S3, EC2, ALB) to CloudFront. The origin fetch is free; CloudFront charges for delivery to viewers.
• In over Direct Connect or Site-to-Site VPN. Data into AWS is free; you pay port-hours or connection-hours.
• VPC peering within one AZ. Since May 2021, peering traffic that stays in one AZ is free (lesson 22.1).
• A gateway endpoint. No hourly fee and no per-GB fee (lesson 22.2).

#Charged: leaving an AZ, a Region or AWS

Prices checked against the AWS price list in November 2026. They differ by Region and change over time: always check the pricing page or the AWS Pricing Calculator before you trust a number.

Two reading rules matter more than the numbers:

1. “Each direction” means you pay twice for one transfer. One gigabyte that moves from AZ-a to AZ-b is billed $0.01 as it leaves AZ-a and $0.01 as it arrives in AZ-b: $0.02 per GB moved. When both instances are in your account, both halves are on your bill.
2. The direction that leaves is the expensive one. Within a Region you pay a cent; leaving the Region costs two cents or more; leaving AWS costs nine cents or more. The further the data goes, the more it costs.

#Public IP or private IP inside a Region

Inside one AZ, two instances can talk for free, but only over their private addresses. If one sends to the other’s public or Elastic IP, the traffic is billed like cross-AZ traffic, $0.01 per GB each way, even though both servers sit side by side. Using a private IP is also faster: the traffic does not detour through the edge of the VPC.

How it happens: a hard-coded Elastic IP in a config file, a public DNS name that resolves to a public address, or a client that reaches its own company’s service through the public endpoint. The fix is free: use private IPs, or names that resolve to private IPs inside the VPC (with DNS hostnames on, an instance’s public DNS name resolves to its private IP from inside the VPC).

#Cross-AZ traffic and high availability

Production systems run in at least two AZs (lesson 1.2), so some traffic must cross AZs. The skill is to pay for the crossings that buy availability and avoid the ones that buy nothing.

What crosses AZs, and who pays:

• App servers to a database in another AZ: charged, both ways. Half of a two-AZ app fleet always talks to a primary database in the other AZ.
• RDS Multi-AZ replication (primary to standby): free. You pay for the standby instance and its storage, not for the replication bytes.
• RDS read replica in the same Region, in any AZ: replication is free (lesson 7.1). In another Region, replication is billed as inter-Region transfer.
• Readers of a read replica: normal rules. Analytics servers in the replica’s AZ read for free; in another AZ they pay cross-AZ.
• Load balancers: an ALB sends to targets in other AZs at no data transfer charge; with cross-zone load balancing on an NLB or GWLB, the bytes that cross AZs are charged as normal inter-AZ transfer (lesson 6.4).
• A NAT gateway in another AZ: charged, on top of the NAT processing fee (next section).

#NAT gateway or VPC endpoint

A NAT gateway charges twice: by the hour while it exists, and by the gigabyte for everything it processes, in both directions. In us-east-1 that is about $0.045 an hour (about $33 a month) and $0.045 per GB; in Mumbai about $0.056 for each. On top of that come normal data transfer charges: data out to the internet, or cross-AZ if the NAT gateway is in another AZ. Traffic to S3 and DynamoDB in the same Region has no transfer charge, so for those services the NAT fee is pure overhead.

The same 10 TB a month from S3 in the same Region, us-east-1 prices, 730-hour month:

In Mumbai the NAT line is about $614 and the interface endpoint about $121 (its hourly price is $0.013 there); the gateway endpoint is still $0.

#Connecting VPCs: peering, Transit Gateway or PrivateLink

The three ways to connect VPCs (lessons 22.1, 22.2 and 22.6) have different price shapes:

A worked comparison: two VPCs in one account exchange 30 TB a month, and half of it crosses AZs.

• Peering: no hourly fee; 15 TB stays in an AZ (free); 15 TB crosses AZs: 15,360 × $0.02 = $307.
• Transit Gateway (us-east-1): 2 attachments × 730 × $0.05 = $73, plus 30,720 GB × $0.02 = $614: $687. No cross-AZ charge comes on top: since April 2022 AWS does not bill inter-AZ data transfer through a transit gateway (or PrivateLink), only the $0.02 processing.

For two or three VPCs that talk a lot, peering is the cheaper road. For 50 VPCs, the mesh of 1,225 peering connections is an operational nightmare (lesson 22.1), and Transit Gateway’s fees buy you a network you can manage: that is a trade-off the exam expects you to see, not a mistake. A common pattern combines both: everything on a transit gateway, plus a direct peering connection between the two VPCs that exchange the most data.

#Getting data out of AWS

#Ingress is free, egress is not

Ingress is traffic coming into AWS; it is free. Egress is traffic going out of AWS, to the internet or to your own network, and it is the most expensive arrow on the map. So the main rule for egress is simple: send less of it, and when you must send it, send it the cheapest way.

#Compute close to the data

A bank keeps its database in AWS but runs its reporting tool in the office. Each report pulls 100 MB of raw rows over the network and turns it into a 50 KB summary. With 10,000 reports a day, that is about 30 TB a month leaving AWS. Move the reporting tool into AWS, next to the database, and only the 50 KB summaries leave: about 15 GB a month. The same work, two thousand times less egress.

The pattern is general: filter, aggregate, compress and render where the data lives, and send out only the answer. Run the ETL job in the Region of the bucket; query with Athena instead of downloading the files; let the database do the join.

#S3, CloudFront, Transfer Acceleration and replication

For data served from S3 (us-east-1 numbers, the ones the exam uses):

• S3 ingress: free.
• S3 to the internet: about $0.09 per GB for the first 10 TB a month (after the account’s 100 GB free).
• S3 to CloudFront: free. CloudFront to the internet: about $0.085 per GB in North America and Europe, lower in higher tiers, with 1 TB a month free. Edges in India charge about $0.109.
• S3 Transfer Acceleration: an extra $0.04 per GB (accelerated through edges in the US, Europe and Japan) or $0.08 (elsewhere), on top of normal transfer, and only charged when it actually made the transfer faster (lesson 10.6).
• S3 cross-Region replication: the replicated bytes are billed as inter-Region transfer ($0.02 per GB from us-east-1, $0.086 from Mumbai), plus replication requests (lesson 10.4).

CloudFront’s per-GB price is only a little lower than S3’s, so where do the savings come from? From the free origin fetch (each object leaves S3 once per edge, not once per viewer), the 1 TB free tier, far fewer S3 GET requests (which have their own charge), smaller origin fleets when the origin is EC2, and committed-use or flat-rate CloudFront pricing for steady traffic (lesson 11.1). And viewers get the data from a nearby edge, which is faster.

#Hybrid egress: VPN or Direct Connect

Data that must come back to your own network leaves AWS either over the internet (a Site-to-Site VPN is still the internet underneath, so it pays internet rates) or over Direct Connect, which has its own, lower per-GB rate plus a port fee:

• Over VPN: $0.05 per connection-hour (us-east-1) plus data out at internet rates.
• Over Direct Connect: a port-hour fee (a 1 Gbps dedicated port is about $0.30 an hour; a 1 Gbps hosted connection in Mumbai about $0.33) plus data out at Direct Connect rates, about $0.02 per GB from US Regions to US locations and $0.045 from Mumbai to Mumbai locations. Partners charge separately for the circuit from your building to the location.

The rate depends on the Region the data leaves and the Direct Connect location it goes to. The slide makes the point that a location that is in the same AWS Region as your workloads gives the lowest egress price. Twenty terabytes a month from Mumbai costs about $1,990 over the internet and about $922 plus the port over Direct Connect: the line pays for itself only above a certain volume, and is usually bought for steady bandwidth and privacy as much as for price (lesson 22.5).

#Public IPv4 addresses

Since February 2024, every public IPv4 address costs about $0.005 an hour (about $3.65 a month), attached or idle, Elastic or auto-assigned (lesson 3.6, not repeated here). Fifty servers with public IPs is about $180 a month for addresses alone. Put servers in private subnets behind a load balancer or NAT gateway, release Elastic IPs you no longer use, and use IPv6 (lesson 22.7) where your clients support it: IPv6 addresses carry no such charge.

#Work out your own bill

Pick a price set, type your monthly volumes, and the calculator itemises the bill and shows a cheaper design for each line. The defaults describe a mid-sized company in Mumbai.

#Design patterns for a cheaper network

1. Use private IPs for everything inside a Region. Never route internal traffic to public or Elastic IPs.
2. Keep chatty traffic inside one AZ when availability allows: a cache node per AZ, AZ-aware routing, readers next to their read replica. Keep two AZs for anything that must stay up.
3. Gateway endpoints for S3 and DynamoDB in every VPC that uses them. Interface endpoints for other services when the traffic is large enough to beat NAT.
4. One NAT gateway per AZ, each AZ’s subnets routed to its own: no cross-AZ NAT traffic, and no single point of failure.
5. CloudFront in front of S3 and EC2 for anything users download.
6. Compute close to the data: process in the data’s Region, send out only results; compress what you must send.
7. Choose the connection by volume: peering for a few heavy VPC pairs, Transit Gateway for many VPCs; Direct Connect when hybrid egress is large and steady.
8. Replicate deliberately: cross-Region copies only for what disaster recovery or local users need.
9. Watch the bill by usage type: Cost Explorer grouped by usage type shows DataTransfer-Regional-Bytes (cross-AZ), DataTransfer-Out-Bytes (internet), NatGateway-Bytes and the inter-Region types; VPC Flow Logs (lesson 22.3) show which instances talk to which.

#What goes wrong

• A NAT gateway line bigger than the servers: S3 or DynamoDB traffic through NAT with no gateway endpoint, or container images pulled from public registries through NAT every deployment.
• Cross-AZ charges with “everything in one AZ”: an instance talks to its neighbour through an Elastic IP or public DNS name.
• One NAT gateway for three AZs: cross-AZ transfer on every byte, and one AZ outage takes out internet access for all.
• An inter-Region line nobody planned: an application in one Region reading a bucket or a database in another on every request, or a replication rule copying everything when DR needed one prefix.
• Videos or downloads served straight from S3 or EC2: full internet egress for every view, and S3 request charges on top.
• Transit Gateway for two VPCs: attachment-hours and $0.02 per GB for traffic that peering would carry free in the same AZ.
• Using us-east-1 numbers for a Mumbai design: inter-Region traffic is four times the textbook price there.
• Idle Elastic IPs and forgotten NAT gateways in test VPCs: both bill every hour (lesson 1.4).

#How this is used in system design

• Cost is a design property. A good design states its data paths and what each costs per GB: the Well-Architected cost pillar asks exactly this. Draw the price map for your architecture before you build it.
• AZ-local, Region-wide. Multi-AZ for availability, but with AZ-affinity in the hot paths: each AZ’s app servers use their own cache, their own NAT gateway and, for reads, a replica in their own AZ.
• Private by default. Private subnets, gateway endpoints for S3 and DynamoDB, interface endpoints for the AWS APIs you use most, NAT only for what truly needs the internet.
• Edge for egress. CloudFront (or Global Accelerator for non-HTTP) in front of anything public; the origin never talks to users directly.
• Hybrid by volume. Site-to-Site VPN while volumes are small or the line is not yet ready; Direct Connect once egress and bandwidth justify the port; VPN stays as the cheap backup.

#Chapter 22 cheat sheet

The whole chapter on one page, with the earlier VPC lessons it builds on. Read the scenario’s keywords, then pick the one row that fits.

#Try it yourself

# 1. Last month's data transfer, grouped by usage type (cross-AZ, internet, NAT, inter-Region)
aws ce get-cost-and-usage \
  --time-period Start=2026-10-01,End=2026-11-01 --granularity MONTHLY \
  --metrics UnblendedCost UsageQuantity \
  --filter '{"Dimensions":{"Key":"USAGE_TYPE_GROUP","Values":["EC2: Data Transfer - Inter AZ","EC2: Data Transfer - Internet (Out)","EC2: Data Transfer - Region to Region (Out)","EC2: NAT Gateway - Data Processed"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE

{
  "ResultsByTime": [{
    "Groups": [
      { "Keys": ["APS3-DataTransfer-Regional-Bytes"],
        "Metrics": { "UnblendedCost": { "Amount": "409.6", "Unit": "USD" },
                     "UsageQuantity": { "Amount": "40960", "Unit": "GB" } } },
      { "Keys": ["APS3-NatGateway-Bytes"],
        "Metrics": { "UnblendedCost": { "Amount": "573.44", "Unit": "USD" },
                     "UsageQuantity": { "Amount": "10240", "Unit": "GB" } } },
      { "Keys": ["APS3-DataTransfer-Out-Bytes"],
        "Metrics": { "UnblendedCost": { "Amount": "1989.63", "Unit": "USD" },
                     "UsageQuantity": { "Amount": "20480", "Unit": "GB" } } }
    ]
  }]
}

DataTransfer-Regional-Bytes is cross-AZ (and public-IP) traffic: its quantity counts each direction, so 40,960 GB here is 20 TB moved. APS3 is the code for ap-south-1 in usage types.

# 2. Look up a price instead of guessing it: NAT gateway in Mumbai
aws pricing get-products --region us-east-1 --service-code AmazonEC2 \
  --filters Type=TERM_MATCH,Field=usagetype,Value=APS3-NatGateway-Bytes \
  --query "PriceList[0]" --output text | jq '.terms.OnDemand[].priceDimensions[] | {description, pricePerUnit}'

# 3. How much is each NAT gateway processing? (bytes in the last 24 hours)
aws cloudwatch get-metric-statistics --namespace AWS/NATGateway \
  --metric-name BytesOutToDestination --dimensions Name=NatGatewayId,Value=nat-0a1b2c3d4e5f67890 \
  --start-time 2026-10-31T00:00:00Z --end-time 2026-11-01T00:00:00Z \
  --period 86400 --statistics Sum

# 4. Which subnets have no S3 gateway endpoint route? (look for a pl-... destination)
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0a1b2c3d4e5f67890 \
  --query "RouteTables[].{rt:RouteTableId,s3:Routes[?DestinationPrefixListId!=null].DestinationPrefixListId}"

# 5. Public IPv4 addresses you are paying for, attached or not
aws ec2 describe-addresses --query "Addresses[].{ip:PublicIp,assoc:AssociationId}"

Then open Cost Explorer, filter on service EC2-Other, group by usage type, and find your largest data transfer line. Match it to a pattern from “What goes wrong”, and use Flow Logs (lesson 22.3) to find which instances produce the traffic.

#Summary

Key takeaways

• Free: in from the internet, same AZ on private IPs, EC2 to S3/DynamoDB in the same Region, AWS origin to CloudFront, data into Direct Connect or VPN, peering inside one AZ, gateway endpoints.
• Charged: cross-AZ $0.01 per GB each direction ($0.02 per GB moved); traffic to a public or Elastic IP inside the Region is charged the same, even in one AZ; inter-Region about $0.02 per GB from us-east-1 (about $0.086 from Mumbai); internet egress about $0.09 per GB after 100 GB free a month, tiered ($0.109 in Mumbai).
• NAT gateway: hourly + about $0.045 per GB processed, plus cross-AZ if the NAT is in another AZ. Gateway endpoint for S3/DynamoDB: $0. Interface endpoint: about $0.01 per AZ-hour + $0.01 per GB.
• Peering: no hourly fee, free in one AZ. Transit Gateway: per attachment-hour + $0.02 per GB. Peering is cheaper for a few heavy VPC pairs; TGW wins on manageability at scale.
• Egress: send less (compute near the data, compress), send it through CloudFront (origin fetch free, 1 TB free, fewer requests), and use Direct Connect for heavy, steady hybrid egress (lower per-GB plus port-hours).
• S3: ingress free, out about $0.09 per GB, to CloudFront free, Transfer Acceleration +$0.04–0.08 per GB, cross-Region replication billed as inter-Region.
• RDS: Multi-AZ and same-Region read replica replication are free; cross-Region replicas pay inter-Region transfer; readers pay cross-AZ like anyone else.
• Every public IPv4 address costs about $0.005 an hour.
• Never trade away a required second AZ to save transfer; reduce what crosses instead. Prices vary by Region and change: check the pricing page.

Self-check: networking costs30 questions