How AWS Data Transfer Pricing Works
| Transfer Type | Cost |
|---|---|
| Internet egress (first 10TB/month) | $0.09/GB |
| Between AZs in same region | $0.01/GB each way |
| Between AWS regions | $0.02–$0.08/GB |
| Within same AZ | Free |
| S3 → CloudFront | Free |
| CloudFront egress to internet | $0.0085–$0.02/GB |
The cross-AZ charge ($0.01/GB each direction = $0.02/GB round trip) is the most common hidden cost. A microservices architecture where services in different AZs call each other frequently can accumulate $5,000–$30,000/month in invisible transfer costs.
Finding Your Transfer Costs
In AWS Cost Explorer, filter by Service = EC2-Other, Usage Type contains "DataTransfer". Sort by cost. The results will show exactly where your transfer charges originate. Enable VPC Flow Logs for granular per-connection visibility.
CloudFront: Cheapest Internet Egress
CloudFront's egress rates are 60–80% lower than direct EC2 or S3 egress. S3 → CloudFront transfer is free. For any public-facing content (web apps, APIs, media), routing via CloudFront almost always reduces cost while improving latency. A service delivering 50TB/month saves ~$3,500/month vs direct S3 egress.
VPC Endpoints Eliminate NAT Costs
Without VPC endpoints, EC2 instances in private subnets access S3 and DynamoDB via NAT Gateway — paying $0.045/GB in NAT processing charges plus $0.01/GB cross-AZ. Gateway VPC endpoints for S3 and DynamoDB are free and route traffic privately. Interface endpoints for other services cost ~$0.01/hour but eliminate NAT processing costs.
Data Locality: Keep Traffic in the Same AZ
Design services that communicate frequently to run in the same AZ. Use AZ-specific endpoint discovery (e.g., in ECS, prefer local AZ task placement). For RDS, use the reader endpoint strategically — reads from a different AZ cost $0.02/GB round trip.
NAT Gateway Cost Reduction
NAT Gateway charges: $0.045/hour (~$32/month) plus $0.045/GB processed. For high-bandwidth private subnets, a self-managed NAT instance (t3.small at $0.0208/hour) can save 50%+ — at the cost of management overhead. Enable VPC endpoints first; they eliminate the largest portion of NAT traffic for most architectures.