AWS Network Charges: Distance, Direction, Path
Follow the same gigabytes from one instance in Mumbai to a neighbour, another zone, N. Virginia and the internet, then through the devices that add their own charge on the way.
One instance, one neighbour, no charge
An instance called app sends data to a database in the same Availability Zone.
The traffic stays inside one zone and uses private addresses, so nothing is metered in either direction.
app → db
| Charge | Rate | Month |
|---|---|---|
| Inside ap-south-1a, private address | free | $0.00 |
| Total for 1,000 GB | $0.00 | |
Same zone, private address: free
An Availability Zone (AZ) is one or more data centres inside a Region. Two instances in the same AZ that talk over their private addresses aren't billed for the bytes they exchange.
- Rate
- $0.00 per GB
- Both conditions needed
- Same AZ and private addresses
No line itemAZ names are mapped per account, so your ap-south-1a can be a different building from another account's. Compare AZ IDs such as aps1-az1 when two accounts need to share a zone.
Amazon EC2 On-Demand pricing: data transfer ↗AWS Architecture Blog: data transfer costs for common architectures ↗
THE POINT TO KEEPDistance is the first thing AWS prices, and the shortest distance is free.
Cross one zone boundary and both ends are metered
The same data now goes to a replica one zone over.
The bytes are counted as they leave app and counted again as they arrive at the replica. Each count is $0.01 a gigabyte, so one gigabyte moved between two of your own instances costs $0.02.
app → replica in ap-south-1b
| Charge | Rate | Month |
|---|---|---|
| Leaves app (out) | $0.01/GB | $10.00 |
| Arrives at the replica (in) | $0.01/GB | $10.00 |
| Total for 1,000 GB | $20.00 | |
Back to the database in the same zone, but app now calls its public address. AWS bills that like a zone crossing, although the packets never leave the AWS network.
app → db, by public address
| Charge | Rate | Month |
|---|---|---|
| Leaves app (out) | $0.01/GB | $10.00 |
| Arrives at the database (in) | $0.01/GB | $10.00 |
| Total for 1,000 GB | $20.00 | |
The charge that hides in ordinary architecture
Spreading a workload over several AZs is standard advice, and every busy pair that lands in different zones pays this rate: app to database, service to service, consumer to broker. No single line looks large, which is why it tends to be found late.
- Rate
- $0.01 per GB at each end
- Billed the same way
- Public or Elastic IPv4 addresses inside the Region
- Not charged
- Replication between a Multi-AZ RDS primary and its standby
APS3-DataTransfer-Regional-BytesSome managed services don't meter their own end, so a crossing to one of them shows one line instead of two. Check the service's pricing page before assuming either.
Amazon EC2 On-Demand pricing: data transfer ↗Cost and Usage Reports: understanding data transfer charges ↗AWS Architecture Blog: data transfer costs for common architectures ↗
THE POINT TO KEEPA gigabyte that crosses an AZ is counted at both ends.
Leaving Mumbai for N. Virginia
A second copy of the data lives in us-east-1.
The Region that sends the data pays. Out of Mumbai that is $0.086 a gigabyte, close to what the internet costs. Arriving in N. Virginia is free.
app → us-east-1
| Charge | Rate | Month |
|---|---|---|
| Leaves ap-south-1 | $0.086/GB | $86.00 |
| Arrives in us-east-1 | free | $0.00 |
| Total for 1,000 GB | $86.00 | |
The same gigabytes coming back cost $0.02. The rate belongs to the Region the data leaves, and us-east-1 is one of the cheapest to leave.
us-east-1 → app
| Charge | Rate | Month |
|---|---|---|
| Leaves us-east-1 | $0.02/GB | $20.00 |
| Arrives in ap-south-1 | free | $0.00 |
| Total for 1,000 GB | $20.00 | |
The price is set by the Region you leave
Transfer between Regions has one rate per source Region, charged on the way out only. That makes a pair of Regions lopsided: sending out of Mumbai costs 4.3 times what the return direction does.
- Mumbai → N. Virginia
- $0.086 per GB
- N. Virginia → Mumbai
- $0.02 per GB
- Receiving Region
- $0.00 per GB
APS3-USE1-AWS-Out-BytesThe same rate applies over inter-Region VPC peering and over public endpoints. A transit gateway adds its own processing charge on top.
AWS Price List bulk API (source of the rates) ↗Cost and Usage Reports: understanding data transfer charges ↗AWS Architecture Blog: data transfer costs for common architectures ↗
THE POINT TO KEEPBetween Regions, the sending Region sets the price and the receiving Region charges nothing.
Out to the internet
Someone outside AWS downloads from app.
The first 100 GB a month are free across the whole account. After that the rate starts at $0.1093 a gigabyte and steps down as the month's total grows.
app → user
| Charge | Rate | Month |
|---|---|---|
| Data transfer out to the internet | tiered | $98.37 |
| Total for 1,000 GB | $98.37 | |
| First 100 GB | 100 GB | free | $0.00 |
|---|---|---|---|
| Next 10 TB | 900 GB | $0.1093/GB | $98.37 |
| Next 40 TB | 0 GB | $0.085/GB | $0.00 |
A free allowance, then tiers
The allowance and the tiers are counted on the account's combined internet traffic from most services and all commercial Regions. Change the monthly volume above the map to see which tiers fill.
- Free
- 100 GB a month, account-wide
- First 10 TB after that
- $0.1093 per GB
- Above 150 TB
- $0.08 per GB
APS3-DataTransfer-Out-BytesThis receipt treats app as the account's only source of internet traffic. In a real account something else has usually used the allowance already.
Amazon EC2 On-Demand pricing: data transfer ↗AWS Price List bulk API (source of the rates) ↗Cost and Usage Reports: understanding data transfer charges ↗
THE POINT TO KEEPThe internet is the most expensive place to send a gigabyte, and the rate depends on the month's total.
The same wire, priced in one direction
Compare a gigabyte arriving with a gigabyte leaving.
Uploads, API requests and anything else arriving from the internet cost nothing to receive. The same volume going back out is metered.
Arriving: user → app
| Charge | Rate | Month |
|---|---|---|
| Data transfer in from the internet | free | $0.00 |
| Total for 1,000 GB | $0.00 | |
Leaving: app → user
| Charge | Rate | Month |
|---|---|---|
| Data transfer out to the internet | tiered | $98.37 |
| Total for 1,000 GB | $98.37 | |
Between Regions the rule is the same: the receiving side is free and the sending side pays its own Region's rate.
Arriving: us-east-1 → app
| Charge | Rate | Month |
|---|---|---|
| Arrives in ap-south-1 | free | $0.00 |
| Total for 1,000 GB | $0.00 | |
Leaving: app → us-east-1
| Charge | Rate | Month |
|---|---|---|
| Leaves ap-south-1 | $0.086/GB | $86.00 |
| Total for 1,000 GB | $86.00 | |
Inside the Region the rule stops working. Between zones, the sending interface and the receiving interface are both metered, so neither direction is free.
Arriving: replica → app
| Charge | Rate | Month |
|---|---|---|
| Leaves the replica (out) | $0.01/GB | $10.00 |
| Arrives at app (in) | $0.01/GB | $10.00 |
| Total for 1,000 GB | $20.00 | |
Leaving: app → replica
| Charge | Rate | Month |
|---|---|---|
| Leaves app (out) | $0.01/GB | $10.00 |
| Arrives at the replica (in) | $0.01/GB | $10.00 |
| Total for 1,000 GB | $20.00 | |
Inbound is free at the edges of a Region
Data arriving from the internet or from another Region is never charged to the receiver. That is the rule people remember, and it holds only at the Region's edge: between AZs there is no free direction.
- Internet → AWS
- $0.00 per GB
- Region → Region
- Sender pays
- AZ → AZ
- Both ends pay
APS3-DataTransfer-In-Bytes at $0.00Free to receive doesn't mean free to answer. A request is small, its response is often large, and the response is outbound.
Amazon EC2 On-Demand pricing: data transfer ↗Cost and Usage Reports: understanding data transfer charges ↗AWS Architecture Blog: data transfer costs for common architectures ↗
THE POINT TO KEEPAWS takes your data for free. It charges to let it leave.
A private instance calls out
app sits in a private subnet, so its calls to a payment API on the internet go through a NAT gateway.
The gateway charges $0.056 for every gigabyte it handles, on top of the internet rate from the earlier view. The first hop is free because the gateway is in app's zone.
app → NAT → payment API
| Charge | Rate | Month |
|---|---|---|
| app → NAT gateway, same AZ | free | $0.00 |
| NAT gateway processing | $0.056/GB | $56.00 |
| Data transfer out to the internet | tiered | $98.37 |
| Total for 1,000 GB | $154.37 | |
ALSO BILLED BY THE HOURNAT gateway: $0.056 an hour, about $40.88 a month.
Many VPCs run one shared gateway to save its hourly charge. Every instance outside the gateway's zone then pays $0.01 a gigabyte to reach it.
app → NAT in ap-south-1b → payment API
| Charge | Rate | Month |
|---|---|---|
| Crosses to ap-south-1b, counted at app | $0.01/GB | $10.00 |
| NAT gateway processing | $0.056/GB | $56.00 |
| Data transfer out to the internet | tiered | $98.37 |
| Total for 1,000 GB | $164.37 | |
ALSO BILLED BY THE HOURNAT gateway: $0.056 an hour, about $40.88 a month.
Processing is charged in both directions
A NAT gateway meters every gigabyte that passes through it, whichever way it is going. Downloads, container image pulls and package updates arrive through the gateway and are processed at the same rate, even though the transfer in is free.
- Processing
- $0.056 per GB, both directions
- Hourly
- $0.056 per gateway
- Shared gateway in another AZ
- Adds the zone crossing
APS3-NatGateway-BytesOne gateway per AZ removes the crossing and adds an hourly charge for each zone; which is cheaper depends on how much traffic crosses. A regional NAT gateway spans zones as one resource and is billed for each zone it covers.
Amazon VPC pricing: NAT gateway, peering, public IPv4 ↗Pricing for NAT gateways ↗AWS Architecture Blog: data transfer costs for common architectures ↗
THE POINT TO KEEPA NAT gateway adds a per-gigabyte charge that distance alone doesn't explain.
Sending to S3 in the same Region
app writes its exports to an S3 bucket in ap-south-1.
From an instance with a public address, traffic reaches S3 through the internet gateway and stays on the AWS network. Transfer between EC2 and S3 in the same Region is free in both directions.
app → S3
| Charge | Rate | Month |
|---|---|---|
| EC2 → S3, same Region | free | $0.00 |
| Total for 1,000 GB | $0.00 | |
app is in a private subnet, so the same upload goes through the NAT gateway. The transfer is still free. The gateway's $0.056 a gigabyte is not.
app → NAT → S3
| Charge | Rate | Month |
|---|---|---|
| app → NAT gateway, same AZ | free | $0.00 |
| NAT gateway processing | $0.056/GB | $56.00 |
| NAT gateway → S3, same Region | free | $0.00 |
| Total for 1,000 GB | $56.00 | |
ALSO BILLED BY THE HOURNAT gateway: $0.056 an hour, about $40.88 a month.
Point the same job at a bucket in another Region and the inter-Region rate comes back, on top of the gateway.
app → NAT → S3 in us-east-1
| Charge | Rate | Month |
|---|---|---|
| app → NAT gateway, same AZ | free | $0.00 |
| NAT gateway processing | $0.056/GB | $56.00 |
| Leaves ap-south-1 | $0.086/GB | $86.00 |
| Total for 1,000 GB | $142.00 | |
ALSO BILLED BY THE HOURNAT gateway: $0.056 an hour, about $40.88 a month.
The service is free. The road to it may not be.
S3 doesn't charge for transfer to or from other AWS services in its own Region, and DynamoDB and many other services follow the same rule. That is a statement about the transfer line only. If a private subnet's route to the service runs through a NAT gateway, the gateway bills for processing.
- EC2 ↔ S3, same Region
- $0.00 per GB
- S3 → CloudFront
- $0.00 per GB
- Transfer Acceleration
- An extra per-GB charge on top of transfer
APS3-NatGateway-Bytes, with no S3 transfer lineS3 request fees and storage are billed separately from data transfer and aren't shown on these receipts.
Amazon S3 pricing: data transfer ↗AWS Architecture Blog: data transfer costs for common architectures ↗Amazon VPC pricing: NAT gateway, peering, public IPv4 ↗
THE POINT TO KEEPA free destination can still have a toll on the way.
A private road to the service
The same upload to S3, without the NAT gateway.
A gateway endpoint is a route table entry that sends S3 and DynamoDB traffic straight to the service. It has no hourly charge and no per-gigabyte charge.
app → gateway endpoint → S3
| Charge | Rate | Month |
|---|---|---|
| app → gateway endpoint | free | $0.00 |
| Gateway endpoint → S3, same Region | free | $0.00 |
| Total for 1,000 GB | $0.00 | |
Most other services, such as ECR, are reached through an interface endpoint: a network interface in your subnet. It charges $0.01 a gigabyte and an hourly rate in each AZ, well below the NAT gateway's $0.056.
app → interface endpoint → ECR
| Charge | Rate | Month |
|---|---|---|
| Interface endpoint processing | $0.01/GB | $10.00 |
| Endpoint → ECR, same Region | free | $0.00 |
| Total for 1,000 GB | $10.00 | |
ALSO BILLED BY THE HOURInterface endpoint, in each AZ: $0.013 an hour, about $9.49 a month.
Two kinds of endpoint, two prices
Gateway endpoints exist only for S3 and DynamoDB, and only for buckets and tables in the VPC's own Region. Everything else uses interface endpoints, which are priced per hour and per gigabyte, so each one needs enough traffic to beat the NAT gateway it replaces.
- Gateway endpoint
- $0.00 per GB, no hourly charge
- Interface endpoint
- $0.01 per GB + $0.013 per hour per AZ
- Pays for itself against NAT
- Above about 206 GB a month per AZ
APS3-VpcEndpoint-BytesA gateway endpoint works through the VPC's route tables, so traffic from an on-premises network or a peered VPC can't use it. Those paths need an interface endpoint.
Gateway endpoints ↗AWS PrivateLink pricing: interface endpoints ↗Amazon VPC pricing: NAT gateway, peering, public IPv4 ↗
THE POINT TO KEEPFor S3 and DynamoDB, a gateway endpoint removes the toll at no cost.
Reaching another VPC
The orders service runs in a second VPC.
A peering connection adds no charge of its own. If both instances are in the same zone, the transfer is free, as it was inside one VPC.
app → orders, peered VPC
| Charge | Rate | Month |
|---|---|---|
| VPC peering, same AZ | free | $0.00 |
| Total for 1,000 GB | $0.00 | |
Across zones, peering traffic is billed like any other zone crossing: once out and once in.
app → orders in ap-south-1b
| Charge | Rate | Month |
|---|---|---|
| Leaves app (out) | $0.01/GB | $10.00 |
| Arrives at orders (in) | $0.01/GB | $10.00 |
| Total for 1,000 GB | $20.00 | |
A transit gateway charges $0.02 for each gigabyte a VPC sends into it, and an hourly rate for every attachment. Peering is cheaper per gigabyte; the gateway is easier to run across many VPCs.
app → transit gateway → orders
| Charge | Rate | Month |
|---|---|---|
| Transit gateway processing | $0.02/GB | $20.00 |
| Transit gateway → VPC B | free | $0.00 |
| Total for 1,000 GB | $20.00 | |
ALSO BILLED BY THE HOURTransit gateway attachment, each VPC: $0.07 an hour, about $51.10 a month.
Two transit gateways peered across Regions process the data once, where the VPC sends it in. The crossing between Regions is then billed at the inter-Region rate.
app → transit gateway → us-east-1
| Charge | Rate | Month |
|---|---|---|
| Transit gateway processing | $0.02/GB | $20.00 |
| Leaves ap-south-1 | $0.086/GB | $86.00 |
| Total for 1,000 GB | $106.00 | |
ALSO BILLED BY THE HOURTransit gateway attachment, each: $0.07 an hour, about $51.10 a month.
Peering is a path. A transit gateway is a meter.
VPC peering has no hourly or processing charge, so only the distance is billed. A transit gateway bills the owner of the sending VPC for every gigabyte and bills each attachment by the hour. Data arriving over a peering attachment from another transit gateway isn't processed a second time.
- VPC peering
- Distance charges only
- Transit gateway
- $0.02 per GB sent in
- Attachment
- $0.07 per hour
APS3-TransitGateway-BytesOn a shared transit gateway the processing charge goes to the account that owns the sending VPC, which may not be the account that owns the gateway. These receipts show the gateway's own charges; standard transfer charges still apply around it.
AWS Transit Gateway pricing ↗Amazon VPC pricing: NAT gateway, peering, public IPv4 ↗AWS Architecture Blog: data transfer costs for common architectures ↗
THE POINT TO KEEPPeering costs what the distance costs. A transit gateway adds its own rate per gigabyte.
Answering users on the internet
Requests arrive through an Application Load Balancer (ALB), and the responses go back the same way.
Responses leave through the load balancer, never through the NAT gateway. The balancer adds about $0.008 a gigabyte in capacity units, and the internet rate applies after the 100 GB allowance.
app → ALB → user
| Charge | Rate | Month |
|---|---|---|
| Load balancer capacity, approximate | $0.008/GB | $8.00 |
| Data transfer out to the internet | tiered | $98.37 |
| Total for 1,000 GB | $106.37 | |
ALSO BILLED BY THE HOURApplication Load Balancer: $0.0239 an hour, about $17.45 a month.
CloudFront fetches from the load balancer for free and delivers from an edge location. Its own allowance is 1 TB a month, and past that its rate for viewers in India is $0.109 against $0.1093 from the Region.
app → ALB → CloudFront → user
| Charge | Rate | Month |
|---|---|---|
| Load balancer capacity, approximate | $0.008/GB | $8.00 |
| ALB → CloudFront, origin fetch | free | $0.00 |
| CloudFront to viewers in India | tiered | $0.00 |
| Total for 1,000 GB | $8.00 | |
| First 1 TB | 1,000 GB | free | $0.00 |
|---|---|---|---|
| Next 9 TB | 0 GB | $0.109/GB | $0.00 |
ALSO BILLED BY THE HOURApplication Load Balancer: $0.0239 an hour, about $17.45 a month.
CloudFront moves the exit more than it discounts it
For viewers in India, CloudFront's per-gigabyte rate is almost the same as leaving Mumbai directly. The saving comes from its larger monthly allowance and from caching: a response served from the edge never reaches the load balancer or the instance, so the Region doesn't process or send it at all.
- Origin → CloudFront
- $0.00 per GB
- CloudFront, India
- $0.109 per GB after 1 TB
- Direct from Mumbai
- $0.1093 per GB after 100 GB
IN-DataTransfer-Out-Bytes, under Amazon CloudFrontThe hop from app to the load balancer isn't priced on these receipts. CloudFront also charges per request and prices by the edge location that serves each viewer, so a global audience pays a blend of rates. Its flat-rate plans replace all of this with a monthly fee.
Amazon CloudFront pay-as-you-go pricing ↗Elastic Load Balancing pricing ↗Amazon EC2 On-Demand pricing: data transfer ↗
THE POINT TO KEEPResponses to users leave through the load balancer or the CDN, and each exit has its own allowance.
Back to your own data centre
A nightly job copies data from app to a data centre in India.
A VPN tunnel rides the internet, so data leaving AWS through it is billed at the internet rate. The connection has its own hourly charge.
app → VPN → data centre
| Charge | Rate | Month |
|---|---|---|
| Data transfer out through the VPN | tiered | $98.37 |
| Total for 1,000 GB | $98.37 | |
ALSO BILLED BY THE HOURSite-to-Site VPN connection: $0.05 an hour, about $36.50 a month.
Over a dedicated link from a Direct Connect location in India, data leaving Mumbai costs $0.045 a gigabyte, about 41% of the internet rate. Data coming in is free. The port is billed by the hour whether or not it carries traffic.
app → Direct Connect → data centre
| Charge | Rate | Month |
|---|---|---|
| Data transfer out over Direct Connect | $0.045/GB | $45.00 |
| Direct Connect location → data centre | free | $0.00 |
| Total for 1,000 GB | $45.00 | |
A dedicated link has its own exit rate
Direct Connect prices outbound data by the pair of source Region and Direct Connect location. Mumbai to a location in India is the cheap pair. The same data leaving Mumbai through a location in Singapore or Virginia costs about what the internet does.
- Direct Connect out, India location
- $0.045 per GB
- Direct Connect in
- $0.00 per GB
- VPN out
- Internet rate + $0.05 per hour
APS3-…-DataXfer-Out:dc.3Port hours and any partner fees are fixed costs that aren't on this receipt. Compare the monthly port cost with the per-gigabyte saving before assuming the link is cheaper.
AWS Direct Connect pricing ↗AWS Site-to-Site VPN pricing ↗AWS Architecture Blog: data transfer costs for common architectures ↗
THE POINT TO KEEPOn the way to your own network, the link you choose sets the exit rate.
One upload, two roads
app uploads to S3 every night. Step through both roads and watch each receipt fill in.
Both roads end at the same bucket in the same Region, and the transfer to S3 is free on both. Everything on the first receipt is the price of the road.
A · Shared NAT gateway
| Charge | Rate | Month |
|---|---|---|
| Crosses to ap-south-1b, counted at app | $0.01/GB | $10.00 |
| NAT gateway processing | $0.056/GB | $56.00 |
| NAT gateway → S3, same Region | free | $0.00 |
| Total for 1,000 GB | $66.00 | |
ALSO BILLED BY THE HOURNAT gateway: $0.056 an hour, about $40.88 a month.
B · Gateway endpoint
| Charge | Rate | Month |
|---|---|---|
| app → gateway endpoint | free | $0.00 |
| Gateway endpoint → S3, same Region | free | $0.00 |
| Total for 1,000 GB | $0.00 | |
Road B saves $66.00 a month, 100% of road A, at 1,000 GB.
The saving is the road, not the destination
Nothing about S3 changed between the two receipts. Adding a gateway endpoint to the private subnet's route table moves S3 traffic off the NAT gateway, and the application keeps using the same bucket name and the same credentials.
- Road A
- $0.066 per GB
- Road B
- $0.00 per GB
- Change required
- One endpoint and its route table association
APS3-NatGateway-Bytes falls; S3 usage is unchangedRoad A counts the zone crossing once, at app's interface. Responses returning through the gateway are processed at the same rate, and S3 request fees apply on both roads. The NAT gateway's hourly charge stays for as long as other traffic needs it.
Amazon VPC pricing: NAT gateway, peering, public IPv4 ↗Gateway endpoints ↗Pricing for NAT gateways ↗
THE POINT TO KEEPBefore negotiating a transfer rate, check whether the traffic needs to be on that road at all.
Distance, direction and path on one map
Every charge on this page, and the line it becomes on the bill.
Rings price the distance. An arrow pointing inward is free at the Region's edge, and the same arrow pointing outward is metered. Devices on the road add their own charge per gigabyte.
Where the gigabyte goes · rate per GB · usage type on the bill
- Same AZ, private address$0.00 per GB
No line item - Other AZ, or a public address in the Region$0.01 at each end
APS3-DataTransfer-Regional-Bytes - Mumbai → N. Virginia$0.086 per GB
APS3-USE1-AWS-Out-Bytes - Internet, after 100 GB$0.1093 down to $0.08
APS3-DataTransfer-Out-Bytes - Anything arriving from outside the Region$0.00 per GB
APS3-DataTransfer-In-Bytes - Through a NAT gateway+ $0.056
APS3-NatGateway-Bytes - Through a gateway endpoint+ $0.00
No line item - Through an interface endpoint+ $0.01
APS3-VpcEndpoint-Bytes - Through a transit gateway+ $0.02
APS3-TransitGateway-Bytes - Through an Application Load Balancerabout + $0.008
APS3-LCUUsage - CloudFront to India, after 1 TBfrom $0.109
IN-DataTransfer-Out-Bytes - Direct Connect, India location$0.045 per GB
APS3-…-DataXfer-Out
Read the bill by usage type
Data transfer never appears as one number. In Cost Explorer, group by usage type and look for names containing Bytes: each row of the table is one of those names. The largest row tells you which ring or which device to look at first.
- 1 · Find
- Group the month's cost by usage type
- 2 · Locate
- Match the largest line to a ring or a device
- 3 · Shorten
- Same AZ, an endpoint, or an edge cache
- 4 · Recheck
- Compare the same usage type next month
Cost Explorer → Group by: Usage typeUsage types with no Region prefix belong to us-east-1. CloudFront's prefix names the area of the edge location, not your Region.
Cost and Usage Reports: understanding data transfer charges ↗AWS Price List bulk API (source of the rates) ↗Amazon EC2 On-Demand pricing: data transfer ↗
THE POINT TO KEEPAsk three questions of any flow: how far does it go, which way, and through what.