Most AWS bills have a line that nobody planned for. It is not compute or storage. It is the cost of moving data around. A service that chats with another service in a different zone, a private server pulling updates through a NAT gateway, a backup copied to another Region: each one adds a few cents per gigabyte, and the cents add up.
That is why AWS data transfer costs surprise so many teams. The rules are not hidden, but they are spread across many pricing pages, and the same gigabyte can be charged more than once as it travels.
This guide pulls the rules together. You will learn:
- What AWS charges for, and what it does not, when data moves
- How egress, cross-AZ, cross-Region, NAT Gateway, and CloudFront charges work
- How to find data transfer costs in your own bill
- A step by step plan, with tactics and examples, for cutting them
- Common mistakes and a simple way to decide where to start
Every claim about AWS pricing links to AWS’s own pages. Rates vary by Region and change over time, so treat the numbers here as examples and confirm current prices before you plan around them.
What Are AWS Data Transfer Costs?
AWS data transfer costs are the per-gigabyte fees AWS charges when data moves between its services and the outside world, between Availability Zones, between Regions, or through networking services such as NAT gateways. Data moving into AWS is usually free, while most outbound and cross-boundary traffic is billed.
The key idea is that AWS charges for the path, not just the amount. Sending 1 GB to a user on the internet, to another zone, or to another Region each has its own price. And if the same gigabyte passes through a NAT gateway or a load balancer on the way, those services can add their own processing fees.
The Core Rules
Four rules explain most of the pricing, according to AWS’s EC2 pricing page and its data transfer overview:
- Inbound is free. AWS does not charge for data transferred in from the internet.
- Same Availability Zone is free. Traffic between resources in the same zone over private IP addresses costs nothing.
- Crossing a boundary costs money. Traffic between Availability Zones, between Regions, or out to the internet is charged per GB.
- Networking services add their own fees. NAT gateways, Transit Gateway, and interface endpoints charge for each GB they process.
AWS Data Transfer Rates at a Glance
This table shows the main paths and what they usually cost. Rates are US examples and change by Region, so check the pricing page for your own.
| Data path | Charged? | Typical rate |
| From the internet into AWS | No | Free |
| Same Availability Zone, private IPs | No | Free |
| Between Availability Zones, same Region | Yes | About $0.01 per GB in each direction |
| Out to the internet | Yes, after 100 GB a month | About $0.09 per GB at the first tier |
| Between Regions | Yes | Varies by source and destination Region |
| AWS origin to Amazon CloudFront | No | Free |
| Out through Direct Connect | Yes | Lower than internet rates; varies by location |
| In through Direct Connect | No | Free |
The internet egress example of $0.09 per GB appears in AWS’s own VPC pricing examples, and AWS lowers the rate in tiers as your monthly volume grows. The cross-AZ charge applies to data moving in and out of EC2 and related services across zones in the same Region, as AWS’s global network FAQ explains.
Free Allowances Worth Knowing
AWS gives every customer 100 GB per month of free data transfer out to the internet, aggregated across all AWS services and Regions, with exceptions for China and GovCloud. This allowance is not limited to the first 12 months, according to AWS’s free tier expansion announcement.
Amazon CloudFront has its own allowance: the first 1 TB of data transfer out per month and the first 10 million HTTP or HTTPS requests are free.
AWS also offers eligible customers free data transfer out to the internet when they move all of their data off AWS, or off a particular service. You request it through AWS Support, and AWS reviews it at the account level. Read the announcement for the conditions.
A Few Quick Calculations
Simple math shows how the pieces behave. These examples use the US rates above and are illustrative.
- 500 GB out to the internet in a month. The first 100 GB is free, so you pay for 400 GB at $0.09, which is $36.
- 5 TB out to the internet. About 4,900 GB is billable at $0.09, or roughly $441, before tier discounts.
- 2 TB a month between two zones. At $0.01 per GB in each direction, that is 2,000 GB × $0.01 × 2, or $40.
None of these numbers is frightening on its own. The trouble starts when a busy system repeats the pattern millions of times.
Why Data Transfer Bills Surprise Teams
A few patterns cause most of the shocks:
- Microservices spread across zones that talk to each other all day.
- Private servers that reach the internet or AWS services through a NAT gateway.
- Replication and backups copied to another Region.
- Large downloads served straight from EC2 or S3 instead of a content delivery network.
- Logs and metrics shipped across Regions or accounts.
- Hub-and-spoke networks where every packet passes through Transit Gateway.
The next section walks through each service so you can see where the fees hide.
AWS Data Transfer Costs by Service
The general rules are simple. The service level details are where bills get complicated. Here is how the most common services behave.
Amazon EC2 and Load Balancers
EC2 data transfer follows the core rules: free inbound, free in the same zone over private IPs, charged across zones and to the internet. One detail catches teams out. Traffic that uses a public or Elastic IP address inside the same Region is billed as regional data transfer, even when both servers sit in the same zone. Use private addresses for internal traffic wherever you can.
Load balancers add their own processing fees on top of data transfer. Check the Elastic Load Balancing pricing page for how each type is billed.
Amazon S3
Data flowing into S3 from the internet is free. Data flowing out to the internet counts toward your monthly allowance and is then charged. Reading from S3 into EC2 in the same Region is not charged for transfer, as AWS’s NAT gateway pricing examples show.
Three S3 patterns carry fees worth watching:
- Cross-Region replication. You pay inter-Region transfer for the copies.
- Direct downloads. Serving big files straight from S3 means internet egress on every download.
- Transfer acceleration. It speeds up long-distance uploads and adds its own charge.
See the S3 pricing page for current rates.
Amazon CloudFront
Amazon CloudFront can lower your transfer bill. AWS says data transferred from AWS origins such as S3, EC2, or load balancers to CloudFront is free. You pay for data going out from CloudFront edge locations and for requests, with the first 1 TB of data transfer out and 10 million requests each month free.
Rates vary by edge location, and AWS offers price classes that let you serve content from lower-priced locations. Caching also means popular files leave your origin once, instead of once per viewer.
Amazon RDS, Redshift, and ElastiCache
AWS says there is a charge for data transferred in and out of Amazon EC2, Amazon RDS, Amazon Redshift, Amazon ElastiCache, and DynamoDB Accelerator instances across Availability Zones in the same Region. So an application server in one zone querying a database in another pays the cross-AZ rate each way.
Cross-Region read replicas and snapshot copies add inter-Region transfer. Check each service’s pricing page for how replication traffic is billed.
NAT Gateway
NAT gateways are the most common source of surprise. According to AWS’s VPC pricing page, you pay for each hour the gateway is available, and a data processing charge for every gigabyte it handles, regardless of where the traffic comes from or goes. In the US East example on that page, both rates are $0.045.
The processing fee stacks with other charges. If a private server sends 1 GB to a website on the internet through a NAT gateway, you pay the $0.045 processing fee and also standard internet egress of $0.09, as AWS’s own example describes. A gateway in a different zone than the server adds cross-AZ transfer too.
Here is an illustrative month. A gateway runs 730 hours and processes 1 TB. Hours cost 730 × $0.045, or about $32.85. Processing costs 1,000 × $0.045, or $45. That is nearly $78 before any internet egress.
VPC Endpoints and AWS PrivateLink
Endpoints keep traffic off the NAT gateway. There are two types:
- Gateway endpoints for Amazon S3 and Amazon DynamoDB carry no additional charge, per AWS’s VPC documentation.
- Interface endpoints, which use AWS PrivateLink, cost an hourly fee per zone plus a per-GB processing fee, and they work with many other services.
AWS’s startup security baseline notes that interface endpoint charges are lower than the equivalent charges for sending the same data through a NAT gateway. For S3 and DynamoDB traffic from private subnets, a gateway endpoint is usually the first fix to try.
VPC Peering
Peering a VPC has no hourly fee. Data charges still follow the standard rules, so traffic within one zone is free, traffic across zones in the same Region is charged, and traffic across Regions uses inter-Region rates. In other words, peering does not make the data path free. It only avoids extra gateway fees.
AWS Transit Gateway
Transit Gateway connects many VPCs and networks through one hub. You pay an hourly fee for each attachment and a per-GB data processing fee for traffic it handles, and standard data transfer charges still apply. In the US example AWS publishes, a VPC attachment costs $0.05 per hour and data processing costs $0.02 per GB.
For a few VPCs, peering is often cheaper. For dozens, the management savings of a hub can justify the fees. Estimate both before you decide.
AWS Direct Connect
AWS Direct Connect uses a private line from your network to AWS. AWS says pricing depends on capacity, port hours, and data transfer out. Data coming into AWS over Direct Connect is free in all locations, and data transfer out is priced by Region and location. AWS’s pricing guide uses an illustrative $0.02 per GB for the contiguous United States, which is lower than typical internet egress.
That can pay off for steady, high-volume transfers. But port fees and colocation or circuit costs apply, so the break-even depends on your volume.
AWS DataSync and Migration Tools
Bulk movers such as AWS DataSync charge per GB copied, and the network paths they use can add transfer fees. Price a large migration in the AWS Pricing Calculator before you start.
Public IPv4 Addresses
Public IPv4 addresses are not data transfer, but they belong on the same network cost checklist. AWS charges an hourly fee for every public IPv4 address, in use or idle. See the VPC pricing page for the current rate.
Where Each Service Hides Its Costs
| Service | What drives the cost | Watch out for |
| EC2 | Egress, cross-AZ traffic | Public or Elastic IP traffic inside a Region |
| S3 | Egress, replication | Direct public downloads of large files |
| CloudFront | Edge egress and requests | Region mix and cache hit rate |
| RDS and ElastiCache | Cross-AZ client traffic | Apps and databases in different zones |
| NAT Gateway | Hours plus per GB processed | Traffic to S3 or AWS services through NAT |
| Interface endpoints | Hours per zone plus per GB | Too many endpoints in too many zones |
| Transit Gateway | Attachments plus per GB | Routing every packet through the hub |
| Direct Connect | Port hours plus egress | Low volume that does not justify the port |
How to Find AWS Data Transfer Costs in Your Bill
Data transfer rarely appears as one clean line. It is spread across usage types, and much of it lands under a catch-all label. Follow these steps to pull it apart.
- Open Cost Explorer. AWS Cost Explorer is the fastest place to start, and the console is free to use.
- Filter to the right service. Much EC2 related data transfer appears under the service name “EC2 – Other.” Filter on it, and also check S3, CloudFront, and RDS.
- Group by usage type. This splits the bill into the paths that matter, such as internet egress, regional traffic, and NAT processing.
- Switch to daily granularity. A jump on one day points to a deployment, a job, or a misconfiguration.
- Group by Region, account, and tag. Find which team, environment, or Region creates the traffic.
- Check NAT gateway metrics. Amazon CloudWatch publishes bytes in and out for each gateway, so you can see which one carries the load.
- Use VPC Flow Logs to find the talkers. VPC Flow Logs record traffic between network interfaces, so you can see which sources and destinations move the most bytes.
- Set alerts. Create AWS Budgets and Cost Anomaly Detection alerts for the usage types that surprised you.
Common Data Transfer Usage Types
AWS adds a Region prefix to usage type names, such as “USE1” for US East (N. Virginia), and names can change over time. These are the ones you will meet most often.
| Usage type (without Region prefix) | What it usually means |
| DataTransfer-Out-Bytes | Data sent out to the internet |
| DataTransfer-Regional-Bytes | Traffic across Availability Zones, or using public or Elastic IPs inside a Region |
| AWS-Out-Bytes and AWS-In-Bytes | Data moving between Regions |
| NatGateway-Bytes | Data processed by a NAT gateway |
| NatGateway-Hours | Hours a NAT gateway was available |
Confirm the exact names in your own report, and use the usage type description to double check the meaning.
Pull the Breakdown From the Command Line
If you prefer scripts, the Cost Explorer API can return the same grouping. This example lists last month’s “EC2 – Other” costs by usage type:
aws ce get-cost-and-usage \
–time-period Start=2026-10-01,End=2026-11-01 \
–granularity MONTHLY \
–metrics UnblendedCost \
–group-by Type=DIMENSION,Key=USAGE_TYPE \
–filter ‘{“Dimensions”:{“Key”:”SERVICE”,”Values”:[“EC2 – Other”]}}’
AWS charges for Cost Explorer API requests, so run it sparingly. For resource level detail, turn on the Cost and Usage Report with resource IDs and query it with Amazon Athena.
Tag Resources So Costs Have Owners
Transfer costs are hard to fix when nobody owns them. Activate cost allocation tags such as team, environment, and application, so reports can show who generates the traffic. A short owner tag on every NAT gateway, load balancer, and replication job is often worth more than any single technical fix.
Read the Pattern, Not Just the Total
When you have the breakdown, ask three questions:
- Is it going out or across? Internet egress points to content delivery and API design. Regional traffic points to zone layout. Inter-Region traffic points to replication and logging.
- Is it steady or spiky? Steady traffic suggests architecture. Spiky traffic suggests jobs, backups, or incidents.
- Is it avoidable? Some traffic is the cost of doing business. Some is a path that could be shorter or cheaper.
Write down the top three usage types by cost. That short list becomes your plan for the next section.
How to Reduce AWS Data Transfer Costs
Once you know which paths cost the most, the fixes are usually small design changes. These are the levers to try, roughly in order of ease.
Replace NAT Traffic With Endpoints
If private servers reach S3 or DynamoDB through a NAT gateway, add a gateway endpoint. AWS says gateway endpoints have no additional charge, and the traffic no longer passes through the NAT gateway’s per-GB processing. For other AWS services with heavy traffic, such as container image pulls or log delivery, compare an interface endpoint with NAT. AWS’s guidance says interface endpoint charges are lower.
Put CloudFront in Front of Public Content
Serving images, downloads, or API responses straight from EC2 or S3 means internet egress on every request. With Amazon CloudFront, AWS says transfer from AWS origins to CloudFront is free, and cached content leaves your origin once instead of once per viewer. Use price classes to avoid the most expensive edge locations if your users do not need them.
Keep Chatty Traffic in One Zone
Cross-AZ traffic is charged in both directions, so a service and its database in different zones pay twice for every exchange. Where your availability needs allow it, keep tightly coupled components in the same zone, and use zone aware routing for services that call each other often. Do not remove multi-zone designs where resilience matters. The goal is to avoid pointless crossings, not to give up high availability.
Use Private IP Addresses Inside a Region
Traffic between instances using public or Elastic IP addresses is billed as regional data transfer, even in one zone. Switching internal calls to private addresses can turn a charged path into a free one.
Compress, Cache, and Trim
Send fewer bytes. Compress responses, cache repeated results, return only the fields a client needs, and avoid chatty APIs that make dozens of calls when one would do. Smaller payloads reduce egress and cross-AZ traffic at once.
Be Careful With Replication and Logs
Copying data to another Region doubles storage and adds transfer. Replicate only what your recovery targets require, and filter logs before shipping them across Regions or accounts. Review old replication rules, because they often outlive the project that needed them.
Pick the Right Region and Layout
Place compute near the data it uses. Keep training data, databases, and applications in the same Region where you can. Moving a workload later is harder than choosing well at the start.
Consider Direct Connect for Steady, Heavy Transfers
If you move large volumes between your own network and AWS every month, Direct Connect can lower the per-GB rate for data out. It also adds port and circuit costs, so model your own volumes before you commit.
Choose the Right Hub Design
For a handful of VPCs, peering usually costs less than a Transit Gateway. For many VPCs, a hub can simplify routing. Price both options with your expected traffic before choosing.
Use the Exit Waiver If You Are Leaving
If you are moving all of your data off AWS, ask AWS Support about the free data transfer out program described in AWS’s announcement. It applies only to a real move off AWS, not to routine traffic.
A Step by Step Plan to Cut Data Transfer Costs
- Find the top three usage types. Use Cost Explorer, grouped by usage type.
- Map each one to a path. Decide whether it is egress, cross-AZ, cross-Region, or NAT traffic.
- Identify the source. Use tags, NAT metrics, and VPC Flow Logs.
- Fix the easy ones first. Add endpoints, switch to private IPs, and stop unneeded replication.
- Add caching and a CDN. Put CloudFront in front of public content.
- Redesign the chatty paths. Co-locate tightly coupled services where resilience allows.
- Model bigger changes. Compare Direct Connect, Transit Gateway, or peering with the AWS Pricing Calculator.
- Set alerts and review monthly. Track the usage types that mattered, and watch for new ones.
Which Tactic Fits Which Problem?
| Tactic | Targets | Effort | Risk |
| Gateway endpoints for S3 and DynamoDB | NAT processing fees | Low | Low |
| Private IPs for internal calls | Regional transfer | Low | Low |
| CloudFront for public content | Internet egress | Medium | Low |
| Compression and caching | Egress and cross-AZ traffic | Medium | Low |
| Interface endpoints | NAT fees for AWS services | Medium | Medium |
| Zone aware routing | Cross-AZ traffic | Medium | Medium |
| Replication cleanup | Inter-Region transfer | Medium | Medium |
| Direct Connect | Large steady egress | High | Financial |
Estimate Data Transfer Costs Before You Build
You can predict most of the bill with a simple worksheet. List each data flow, estimate the monthly gigabytes, multiply by the rate, and add fixed fees. The AWS Pricing Calculator can model many of these flows for you.
Here is a hypothetical example for a mid sized application:
| Flow | GB per month | Rate used | Monthly cost |
| Internet egress | 3,000 | $0.09 after 100 GB free | $261.00 |
| App to database across zones | 4,000 | $0.01 each way | $80.00 |
| NAT gateway processing | 2,500 | $0.045 | $112.50 |
| Replication to another Region | 1,500 | $0.02, assumed | $30.00 |
| Total | $483.50 |
Now test an improvement. If 1,800 GB of the NAT traffic is S3 access, a gateway endpoint removes that processing charge and saves 1,800 × $0.045, or $81 a month. The inter-Region rate is an assumption for the example, so use your own Region pair.
Common AWS Data Transfer Mistakes
- Ignoring the path. Looking only at gigabytes and not at where they travel.
- Sending S3 traffic through NAT. One of the most avoidable charges on the bill.
- Using public IPs for internal calls. It turns free traffic into charged traffic.
- Serving big files directly from origin. A CDN is usually cheaper and faster.
- Over-replicating. Copies in extra Regions rarely pay for themselves.
- Forgetting that fees stack. NAT processing, egress, and cross-AZ charges can apply to one request.
- Skipping tags and alerts. Without them, a quiet misconfiguration runs for months.
One honest limit applies. Rates differ by Region and change over time, and negotiated or committed discounts may alter your numbers. Confirm current prices on AWS’s pricing pages before you decide.
Decision Guide: Where Should You Start?
- Your NAT gateway line is large: add gateway endpoints, then review interface endpoints.
- Your internet egress is large: put CloudFront in front of public content and compress responses.
- Your regional transfer is large: check public IP use and zone layout.
- Your inter-Region transfer is large: review replication, logging, and workload placement.
- Your volumes are steady and high: model Direct Connect.
- You cannot tell: start with Cost Explorer by usage type and VPC Flow Logs.
Balance Cost, Resilience, and Performance
Cheaper is not always better. Some data transfer costs buy you real protection. Multi-zone designs survive a zone failure. Cross-Region copies support disaster recovery. Private connectivity improves security and consistency.
Before you change a path, ask these questions:
- What failure or risk does this traffic protect against?
- Would a cheaper design still meet our recovery and uptime goals?
- Will the change add latency for users or for downstream services?
- Who owns this path, and who must approve the change?
- How will we measure the saving, and how will we notice if something breaks?
AWS’s Well-Architected Framework treats cost optimization as one of six pillars, alongside reliability and security, for this reason. The aim is the lowest cost that still meets your requirements, not the lowest cost at any price.
When the answer is unclear, make the change in a test environment first, compare cost and behavior for a few days, and then roll it out in stages.
Practical Examples
These scenarios are illustrative, not real customer cases.
The quiet NAT gateway. A team notices NAT processing among its top charges. Flow data shows most of the bytes go to S3. They add a gateway endpoint and the processing charge for that traffic disappears.
The popular download. A software company serves installers straight from S3. After moving them behind CloudFront, origin egress falls, and the first terabyte of CloudFront delivery each month is free.
The zone split. A web tier in one zone queries a database in another, and cross-AZ charges grow with traffic. The team uses caching and keeps read-heavy paths local, and the monthly regional transfer line shrinks.
Conclusion
AWS data transfer costs are not a mystery once you follow the data. Inbound is free, the same zone is free, and most other paths are charged per GB, with extra fees from NAT gateways, Transit Gateway, and endpoints. Find the top usage types in Cost Explorer, trace them with tags and Flow Logs, and fix the easy paths first: endpoints, private IPs, CloudFront, and tighter replication.
Start this week by grouping last month’s bill by usage type and writing down the top three. That small list is the beginning of a smaller bill.
