AWS data transfer costs: every path a byte takes, and what it costs.
AWS prices data transfer by the path a byte takes, not by the service that sent it. Data into AWS is free. Data out to the internet, across Availability Zones and between Regions is metered, and NAT Gateway adds its own charge on top. This page maps every path, shows how to find your number in Cost Explorer and the Cost and Usage Report (CUR), and lists the fixes in order.
- Data transfer is priced by path. Data INTO AWS is free. Data OUT to the internet is about $0.09/GB at the first tier and falls at volume. Cross-AZ traffic is about $0.01/GB in EACH direction. Inter-Region traffic is about $0.02/GB for most Region pairs. Same-AZ traffic over private IPs is free. NAT Gateway adds about $0.045/GB on top, so one byte can be billed two or three times.
- Four offenders cause most of the spend: cross-AZ chatter between services split across AZs, NAT Gateway carrying AWS-to-AWS traffic that belongs on a VPC endpoint, internet egress served without CloudFront, and inter-Region replication. The fixes are mechanical: VPC endpoints, same-AZ placement, CloudFront, PrivateLink and compression.
- You can do all of it in-house. If you want help, a vetted AWS partner can attribute the spend in the CUR and VPC Flow Logs and deploy the fixes. A cost cleanup on its own is normal paid work. If it is part of a migration, a test or new work on AWS, the partner also checks MAP, POC or IW funding.
IWhy data transfer is the most confusing line on the bill
Other AWS costs count something you provisioned: instance-hours, gigabytes stored, requests. Data transfer counts an event you never see: a packet crossing from one place to another. That is why it is hard to predict and easy to ignore.
It is priced by where data moves, not by which service moved it. The same gigabyte costs nothing inside one Availability Zone over private IPs, about a cent each way across AZs, about two cents between Regions, and about nine cents out to the internet, before NAT Gateway adds its own charge. So a "database cost" investigation often ends at a networking line.
The defaults that create it are all correct. Multi-AZ creates cross-AZ traffic, private subnets create NAT traffic, replication creates inter-Region traffic, and serving users creates internet egress. Nobody questions them, so the spend grows until someone lines it up against the architecture and asks, charge by charge, whether each byte needs that path.
IIThe data-transfer pricing map: every path a byte can take
There are only a few paths. Once you can name them, the bill is readable. Rates below are representative US-Region figures; check the current rates for your Region on the AWS pricing pages, since they vary by Region and step down at volume.
- Inbound (internet to AWS): Free in every Region. Uploads, inbound API calls and ingest pipelines carry no transfer charge.
- Internet egress (AWS to internet): About $0.09/GB for the first 10 TB a month, falling at higher volume, with the first 100 GB a month free. This is what you pay to serve browsers, apps and outside systems, and it is where CloudFront changes the math.
- Cross-AZ (between AZs in one Region): About $0.01/GB in each direction, so a request and its response are both billed. It feels internal, but a busy multi-AZ app moves a lot of it.
- Same-AZ over private IPs: Free. Send the same traffic over a public IP or an Elastic IP and it can be charged even inside one AZ. Private addressing is the free path.
- Inter-Region (Region to Region): About $0.02/GB for most Region pairs. Cross-Region replication, read replicas and snapshot copies pay this on every byte, and replication runs all the time.
- Through NAT Gateway: About $0.045/GB of data processing on top of the transfer itself. Internet egress through NAT pays both. AWS-to-AWS traffic through NAT pays the NAT charge for bytes a VPC endpoint would carry for free or close to it.
- Public path vs private path: Reaching an AWS service over its public endpoint can route through NAT and stack charges. Reaching it over a VPC endpoint keeps it on the AWS network: free for the S3 and DynamoDB gateway endpoints, about $0.01/GB for interface endpoints.
Data into AWS is free and data inside one AZ on private IPs is free. Everything else (cross-AZ, inter-Region, internet egress and the NAT charge) is metered and stacks. The work is moving each kind of traffic to its cheapest correct path.
IIIHow to read data transfer in Cost Explorer and the CUR
Cost Explorer gives you the totals in a few minutes. The Cost and Usage Report gives you the resource-level detail that tells you which path to fix.
Step 1: get the totals in Cost Explorer
Open Cost Explorer, pick monthly granularity over the last few months, and group by Usage Type. Read the codes: DataTransfer-Out-Bytes is internet egress, DataTransfer-Regional-Bytes is cross-AZ (billed both ways), DataTransfer-Inter-Region is Region to Region, and NatGateway-Bytes is NAT processing. Prefixes like USE1- tell you the Region.
Large internet egress points at CloudFront. Large regional bytes point at cross-AZ chatter. A large inter-Region line points at replication you can scope or compress. Add a Cost Anomaly Detection monitor on these usage types so a new chatty workload shows up early.
Step 2: attribute it in the CUR and VPC Flow Logs
The CUR is the line-item export to S3, queryable with Athena. Group lineItem/UsageType and lineItem/ResourceId by cost, descending, and you get transfer spend ranked by resource: which load balancer, which NAT Gateway, which bucket, which replica.
For cross-AZ and NAT traffic, add VPC Flow Logs. Aggregate bytes by source and destination subnet and AZ to see which service pairs talk across AZs and what dominates the NAT path. The result is one sentence you can act on, for example: "most of our transfer is app-to-cache across AZs, then cacheable egress without a CDN, then S3 over NAT."
IVThe four offenders behind most transfer bills
The same four patterns cause most data-transfer spend. Your CUR breakdown maps straight onto this list.
Offender 1: cross-AZ chatter
Spreading services across AZs is correct for availability, but every request that crosses an AZ pays about $0.01/GB each way. An app tier talking to a database, cache or broker in another AZ, all day, in both directions, adds up. Database and cache replication across AZs adds more.
Offender 2: NAT Gateway carrying AWS traffic
S3 reads, ECR image pulls, DynamoDB calls and other AWS API traffic from private subnets often route through NAT and pay about $0.045/GB for bytes a VPC endpoint carries for free (S3 and DynamoDB gateway endpoints) or for about $0.01/GB (interface endpoints). The NAT Gateway cost page covers this in depth.
Offender 3: internet egress without a CDN
Serving assets and API responses straight from EC2, a load balancer or S3 pays the full egress rate on every byte. CloudFront egress costs less per GB, origin-to-CloudFront transfer is free, and cached requests never reach the origin. You cut both the rate and the volume.
Offender 4: inter-Region replication
Disaster recovery and latency setups replicate all the time, and every byte pays about $0.02/GB. S3 Cross-Region Replication, cross-Region read replicas, DynamoDB global tables and snapshot copies are the usual sources. The lever is to replicate less and smaller: only the data that needs a second Region, compressed.
VThe fixes, in priority order
Once you know which path dominates, the fixes are mechanical and low-risk. The first two are free.
Fix 1: VPC endpoints for AWS-to-AWS traffic
Add gateway VPC endpoints for S3 and DynamoDB. They have no hourly or per-GB charge and take that traffic off the NAT path. For other busy AWS services (ECR, CloudWatch, Secrets Manager, SSM, STS, SQS, KMS), add interface endpoints: a small hourly fee per endpoint per AZ plus about $0.01/GB, roughly a quarter of the NAT rate.
Fix 2: same-AZ placement and private addressing
Keep tightly coupled, high-traffic pairs (app and cache, app and read replica) in the same AZ, and keep a second AZ for failover rather than steady traffic. Use AZ-aware clients and topology-aware routing so reads stay local, and make sure internal traffic uses private IPs.
Fix 3: CloudFront in front of internet egress
Put CloudFront in front of anything cacheable or high-volume: static assets, media, downloads and cacheable API responses. Origin-to-CloudFront transfer is free and edge caching removes repeat requests from the origin.
Fix 4: PrivateLink for cross-account traffic
When services in different VPCs or accounts talk, AWS PrivateLink keeps the traffic on the AWS network instead of sending it out and back through NAT and the internet.
Fix 5: compression, and the S3 Transfer Acceleration trap
For traffic you cannot reroute, shrink it: Gzip or Brotli on responses, compressed payloads before replication, efficient serialization. One trap: S3 Transfer Acceleration speeds up long-distance uploads but adds a per-GB fee on top of normal transfer. It buys speed, not savings.
VIA data-transfer diagnosis workflow
Quantify, attribute, take the free wins, then optimize what is left. Free reroutes come before paid fixes, and attribution comes before action.
- 1. Quantify in Cost Explorer: Group by usage type and read the split across internet egress, cross-AZ, inter-Region and NAT.
- 2. Attribute in the CUR and Flow Logs: Rank transfer cost by resource in Athena; rank cross-AZ pairs and NAT destinations in Flow Logs.
- 3. Deploy the free wins: S3 and DynamoDB gateway endpoints, same-AZ placement for the top pairs, private addressing. Test connectivity in staging first.
- 4. Deploy the near-free wins: Interface endpoints for busy AWS services, CloudFront for cacheable egress, PrivateLink for cross-account traffic.
- 5. Optimize what is left: Compress real egress and needed replication, scope replication, and remove Transfer Acceleration where it was added for cost.
- 6. Keep it fixed: Cost Anomaly Detection on transfer usage types, a budget alert, and cost allocation tags so the next chatty workload is caught early.
VIIDoing it yourself, or with a partner
Everything above is doable in-house if you have the time to decode usage types, query Flow Logs and change routes without breaking connectivity. If you do not, a partner can do it.
CloudRoute matches you with one vetted AWS partner that fits the work. The partner attributes your transfer spend in the CUR and Flow Logs, then deploys the endpoints, placement changes, CloudFront and compression, tested in staging. The same review usually turns up nearby savings too: idle resources, right-sizing and commitment coverage.
Who pays: a cost cleanup on its own is normal paid work, and you decide whether the savings justify it. AWS funding that a partner can file comes through three routes: MAP when you migrate to AWS, POC when you test something, and incremental workload (IW) funding when you launch new work on AWS. If your network work is part of one of those, the partner checks whether it qualifies. For startups that is typically $50K to $150K. Depends on the workload; AWS approves.
Nothing. CloudRoute is free for startups. Partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding.
Data-transfer scenarios, what they cost, and the fix
Each common scenario next to its rate and its fix. Rates are representative US-Region figures; check current pricing for your Region.
| Scenario (the path a byte takes) | Representative rate | Why it happens | The fix |
|---|---|---|---|
| Inbound from the internet | $0/GB | AWS does not charge for data in | Nothing to fix |
| Same-AZ over private IPs | $0/GB | Resources in one AZ on private addresses | Keep hot internal traffic same-AZ and private |
| S3 or DynamoDB from a private subnet | $0 with an endpoint vs ~$0.045/GB through NAT | Default route goes out through NAT | Gateway VPC endpoint (free) |
| Other AWS APIs (ECR, CloudWatch, Secrets Manager) through NAT | ~$0.045/GB through NAT vs ~$0.01/GB with an endpoint | AWS service reached over the public path | Interface endpoint (PrivateLink) |
| Cross-AZ service chatter (app to database or cache) | ~$0.01/GB each direction | Services split across AZs, talking constantly | Same-AZ placement for hot pairs |
| Internet egress straight from EC2, ALB or S3 | ~$0.09/GB (first tier) | Serving users from the origin | CloudFront in front |
| Cross-account service traffic | NAT plus internet egress | Reaching another VPC over the public path | PrivateLink |
| Inter-Region replication | ~$0.02/GB, continuously | Replication for DR or latency | Scope it and compress |
| Internet egress through NAT | ~$0.045 NAT plus ~$0.09 internet | Private subnet sending real internet traffic | Compress; use NAT only for real internet egress |
| Upload with S3 Transfer Acceleration | Normal transfer plus an acceleration fee | Turned on for speed | Use it only when upload latency matters |
How a match works (example)
- You tell us about the work
You fill in a short form: what you run today, what you want to move, test or build, your stage and your region.
- We pick one partner
We read your answers and pick one vetted AWS consulting partner that fits the work, the stack and the region. We reply within 24 hours; your matched partner reaches out within 5 business days.
- The partner checks which funding fits
Your matched partner scopes the work with you. Then it checks which partner-filed funding fits: MAP if you are moving to AWS, POC if you want to test something, or incremental workload (IW) funding if you are already on AWS and launching new work.
- The partner files, AWS decides
If the work qualifies, the partner files the funding request with AWS. AWS reviews it and decides. The amount depends on the workload.
- You pay nothing
CloudRoute is free for startups. Partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding.
AWS Activate credits are separate, and you apply for them yourself. Use Activate Founders if no investor backs you. Use Activate Portfolio with the Org ID or invite from your VC, accelerator, incubator or angel group if it is an Activate Provider. A consulting partner cannot apply for Activate on your behalf.
Common questions
How much does AWS data transfer cost?
Why is my AWS data transfer bill so high?
How do I reduce AWS data transfer costs?
What is cross-AZ data transfer and why does it cost money?
Is data transfer into AWS free?
Does CloudFront reduce data transfer costs?
Is S3 Transfer Acceleration a cost optimization?
Can AWS pay for a data-transfer cleanup?
Find out how much of your bill is data transfer, and cut it
CloudRoute matches you with a vetted AWS partner who maps your transfer spend in the CUR, moves it to the cheap paths and adds CloudFront where it pays. If the work is part of a migration, a test or new work on AWS, the partner also checks MAP, POC or IW funding: typically $50K to $150K for startups. Depends on the workload; AWS approves. CloudRoute is free for startups.