AWS data transfer pricing is the line item most FinOps reviews skip, because it doesn't show up as a single obvious service the way an oversized EC2 fleet or an idle RDS instance does. It's spread across dozens of transfer categories — cross-AZ, cross-region, NAT Gateway processing, internet egress — each individually small enough to escape scrutiny, collectively large enough to be 15-20% of a compute-heavy account's total bill in architectures that weren't designed with transfer costs in mind.
Cross-AZ Traffic: The One Almost Nobody Budgets For
Traffic between Availability Zones within the same region is not free — it's billed in both directions at a per-GB rate, which surprises teams who assume "same region" means "no transfer cost." A common architecture that triggers this unexpectedly: an application tier in one AZ making frequent calls to a database or cache in a different AZ, multiplied across every request.
# terraform: forcing AZ-local read replica routing to avoid cross-AZ read traffic
resource "aws_elasticache_replication_group" "cache" {
replication_group_id = "app-cache"
num_cache_clusters = 3
# Application connects to the reader endpoint in its own AZ where possible,
# rather than always hitting the primary across AZs for read traffic
multi_az_enabled = true
preferred_cache_cluster_azs = [
"us-east-1a",
"us-east-1b",
"us-east-1c",
]
}
The fix isn't always architectural — sometimes it's as simple as ensuring application instances and their database connections are pinned to matching AZs where the workload tolerates it, or accepting the cross-AZ cost explicitly for the availability benefit multi-AZ deployment provides, which is a legitimate tradeoff as long as it's a chosen one rather than an undiagnosed bill surprise.
NAT Gateway Data Processing: Already a Known Cost, Still Underpriced Mentally
NAT Gateway charges both an hourly rate and a per-GB data processing fee for every byte that flows through it — outbound calls from private subnets to the internet, to other AWS services without a VPC endpoint, and to other VPCs without peering. Teams that know NAT Gateway costs money often still underestimate it, because the per-GB fee compounds with volume in a way that's easy to miss until a service's traffic grows.
# Identify VPC endpoint gaps — services with high NAT-routed traffic that could use an endpoint instead
aws ec2 describe-vpc-endpoints --query 'VpcEndpoints[*].ServiceName' --output table
# Compare against AWS services actually in use (S3, DynamoDB, ECR, Secrets Manager, etc.)
# Any gap between "services used" and "endpoints configured" is NAT-routed traffic
# that could route through a gateway or interface endpoint instead, at lower cost
S3 and DynamoDB support gateway endpoints at no additional cost beyond the endpoint itself — routing that traffic away from NAT Gateway eliminates both the NAT data processing fee and, for high-volume workloads, meaningfully reduces total transfer spend. Interface endpoints (for services like Secrets Manager, ECR, and CloudWatch Logs) carry their own hourly and per-GB charges but are typically still cheaper than NAT Gateway processing for the same traffic at scale.
Inter-Region Replication: A Real Cost of a Real Requirement
Cross-region data transfer — for disaster recovery replication, multi-region active-active architectures, or cross-region backup copies — is billed at a meaningfully higher per-GB rate than intra-region traffic. This is often a necessary cost for a legitimate continuity or latency requirement, not a mistake to eliminate, but it should be a sized and monitored line item rather than an unexamined one. Replicating an entire dataset continuously when only a subset actually needs cross-region availability is the common overspend pattern here — scope replication to what the DR or latency requirement actually needs, not the whole dataset by default.
Internet Egress: Still the Largest Line Item for Many Workloads
Data transferred out to the internet — API responses to end users, file downloads, CDN origin fetches — remains one of the largest transfer cost categories for customer-facing applications. CloudFront in front of S3 or an application load balancer moves a meaningful share of that traffic to CloudFront's pricing, which is typically lower than direct EC2/ALB internet egress at volume, in addition to the latency and caching benefits.
Frequently Asked Questions
Is cross-AZ traffic something we should eliminate entirely?
No — cross-AZ traffic is often the direct cost of the availability a multi-AZ architecture provides, and eliminating it entirely usually means sacrificing that availability. The goal is making it a deliberate, sized tradeoff rather than an unexamined cost from an architecture nobody reviewed for transfer implications.
How do we see data transfer costs broken down by category in AWS billing?
Cost Explorer's usage type filter can isolate transfer categories (DataTransfer-Out-Bytes, DataTransfer-Regional-Bytes, and similar usage type codes), but the breakdown by specific source/destination pair requires enabling VPC Flow Logs and correlating with Cost and Usage Report data — Cost Explorer alone gives category totals, not per-resource attribution.
Do VPC endpoints always save money over NAT Gateway?
Gateway endpoints (S3, DynamoDB) are free and always cheaper than routing the same traffic through NAT. Interface endpoints have their own hourly and per-GB costs, so they're cost-effective at meaningful traffic volume but may not pay back for very low-traffic services — the crossover point depends on actual usage, not a fixed rule.
What's the single highest-impact data transfer fix for most accounts?
Auditing NAT Gateway data processing charges against actual AWS-service traffic and adding gateway endpoints for S3/DynamoDB usage is usually the fastest, lowest-risk fix — it requires no application changes, just VPC route table updates, and it's free to implement for the gateway endpoint types.
Does CloudFront always reduce data transfer costs versus serving directly from origin?
For content with meaningful cache hit rates and geographically distributed users, yes — CloudFront's egress pricing is generally lower than direct EC2/ALB internet egress at volume, and cached responses don't hit the origin at all. For low-traffic or highly dynamic, uncacheable content, the benefit is smaller and depends on the specific traffic pattern.
Rutagon's AWS cost audits include data transfer analysis — cross-AZ patterns, NAT routing gaps, and endpoint coverage — alongside compute and storage rightsizing.
Talk to us about a cost optimization audit → rutagon.com/contact | 907-841-8407 | contact@rutagon.com
Related reading: AWS NAT Gateway Cost Reduction Guide · AWS CloudFront Cost Optimization Guide · AWS Cloud Infrastructure Capability
External reference: AWS Documentation — Understanding Data Transfer Charges