AWS Data Transfer Costs: Pricing, Hidden Charges and How to Reduce Them

13 min read

Amnic

Amnic

AWS

Simplifying Data Transfer Costs across AWS

Table of Contents

No headings found on page

AWS charges $0.09 per GB for the first 10 TB of internet egress each month, $0.045 per GB for NAT Gateway processing and $0.01 per GB each way for cross-AZ traffic. Inbound is free. AWS data transfer costs (sometimes called AWS bandwidth costs or AWS network costs) cover every byte that moves out of an AWS service, across an AZ, or between regions.

The team at Geocodio recently woke up to a $1,000 AWS bill spike caused by a single misrouted S3 call through a NAT Gateway. That kind of surprise is the entire reason this page exists. Cloud cost horror stories like these are more common than most teams expect see the cloud cost horror stories collection for a broader pattern of how these spikes begin. 

Below is the canonical rate card for AWS data transfer (every row cited to an AWS pricing page), the six hidden charges that quietly inflate cloud bills, a worked example on 10 TB of monthly egress and nine reduction tactics engineers have shipped, with the percentage savings to back them up.

AWS data transfer rate card (current $/GB)

Transfer type

Price

Notes

Inbound to AWS (any service, any region)

$0.00

Always free.

Outbound to internet, first 10 TB / month

$0.09 / GB

After 100 GB free tier.

Outbound to internet, next 40 TB (10–50 TB)

$0.085 / GB


Outbound to internet, next 100 TB (50–150 TB)

$0.07 / GB


Outbound to internet, over 150 TB

$0.05 / GB


Free tier, outbound to internet

100 GB / month

Account-wide, most regions.

Cross-AZ within a region

$0.01 / GB each direction

Effectively $0.02 / GB round trip.

Inter-region (typical US to US)

$0.02 / GB

Varies by region pair.

NAT Gateway data processing

$0.045 / GB

Plus $0.045 / hr per gateway.

VPC Interface Endpoint (PrivateLink)

$0.01 / GB

Plus $0.01 / hr per AZ.

VPC Gateway Endpoint (S3, DynamoDB)

$0.00

Free.

CloudFront to internet, first 10 TB

$0.085 / GB

North America and Europe.

Public IPv4 address (in-use or idle)

$0.005 / hr

Charged on attached or idle IPs.

Direct Connect outbound (typical)

~$0.02 / GB

Varies by location pair.

Each row maps to one of the most-searched facts about AWS pricing. The rest of this article unpacks what each one means when it hits production.

What counts as AWS data transfer?

Data transfer is any byte that moves between two endpoints, where at least one is inside AWS. The bill is shaped by three things: direction (in or out), distance (same AZ, cross-AZ, inter-region, or to the public internet) and the path (NAT Gateway, VPC endpoint, peering, Direct Connect, or CloudFront). For a structured overview of how these charges interact with broader cloud infrastructure decisions, the cloud cost management complete guide is a useful companion.

Inbound versus outbound (AWS ingress cost)

Ingress (inbound data transfer to AWS) is always free, in every region, across every service. Upload a 5 TB dataset to S3, ingest 200 GB of webhook payloads into an ALB, push container images to ECR. The byte count going in does not appear as a line item. For a deeper breakdown of the asymmetry, see our explainer on ingress vs egress.

Outbound is where the meter spins. AWS charges $0.09 per GB for the first 10 TB of internet egress each month, drops to $0.05 per GB above 150 TB and gives every account 100 GB of egress free each month. Internal AWS-to-AWS traffic is metered differently depending on the boundary it crosses.

The 100 GB monthly free tier and what it covers

The 100 GB free egress allowance applies per account, per month, aggregated across most regions and covers traffic to the internet from EC2, S3, Lambda and most other services. It does not cover cross-AZ traffic, inter-region replication, or NAT Gateway processing. For most production accounts, this allowance is consumed in the first hour of the month and should not be treated as a planning tool.

AWS data transfer pricing, line by line

Internet egress: the tiered model

The tiered pricing reads like a volume discount but rarely behaves like one. Most workloads sit comfortably inside the first 10 TB tier at $0.09 per GB and the discount at 50 TB and 150 TB is only meaningful for video streaming, large software distribution, or backup egress. If your egress is bursty rather than sustained, you will pay the top tier price on almost every byte. The full rate card sits inside our broader AWS EC2 pricing guide.

Worked example: 50 TB monthly backup egress to an external archive. The first 100 GB is free. The next 10 TB is billed at $0.09 per GB = $900. The next 40 TB (the 10-50 TB tier) is billed at $0.085 per GB = $3,485. Total monthly cost = $4,385. Routing the same workload through CloudFront drops the rate to $0.085 per GB on all 50 TB = $4,250, a $135 saving with no other changes. Switching the same workload to Direct Connect at $0.02 per GB drops it to $1,000, a 77 percent reduction. The break-even point against the Direct Connect port fee (around $220 per month for a 1 Gbps connection) clears in the first 3 TB.

Cross-AZ data transfer within a region

This is the line item that quietly wrecks high-availability architectures. Cross-AZ data transfer is billed $0.01 per GB in each direction, so every gigabyte sent between two AZs in the same region effectively costs $0.02. Corey Quinn at Last Week in AWS put it bluntly:

"When it comes to the exact cost of cross-AZ data transfer, the AWS documentation is a bit ambiguous… As it turns out, they cost the same and the documentation is wrong."

Last Week in AWS

A three-AZ Kafka cluster, a multi-AZ RDS reader fleet, or an EKS cluster where pods land randomly across zones can rack up cross-AZ charges that exceed the compute bill. We cover one specific case (the rack-aware Kafka fix) in the reduction tactics section below.

Worked example: a 30-pod EKS service across 3 AZs. Each pod handles 200 requests per second, each request triggers a 50 KB read from a cross-AZ Redis cluster. That is 30 × 200 × 50 KB = 300 MB per second of cross-AZ traffic, or roughly 25 TB per day. Billed each direction at $0.01 per GB: 25,000 × $0.02 = $500 per day, $15,000 per month, just on Redis reads. Adding zone-affinity hints in Kubernetes (so each pod prefers the same-AZ Redis replica) cuts this to roughly $1,500 per month, a 90 percent reduction. The deeper EKS cost playbook lives in our EKS cost optimization guide.

Inter-region data transfer

Inter-region pricing varies by the source and destination pair. EC2 and S3 share the same per-GB rate card for inter-region transfer. South America and parts of Asia carry premium rates. If you replicate an S3 bucket from US-East-1 to São Paulo for compliance, the replication itself is metered at the inter-region price. For a full breakdown of Amazon EC2 costs including how inter-region traffic interacts with instance-level charges, that guide covers the relationship in detail.

Source → Destination

Price

US-East-1 (N. Virginia) → US-West-2 (Oregon)

$0.02 / GB

US-East-2 (Ohio) → AP-Northeast-1 (Tokyo)

$0.02 / GB

US-East-1 → EU-West-1 (Ireland)

$0.02 / GB

US-East-1 → SA-East-1 (São Paulo)

$0.09 / GB

EU-West-1 → AP-South-1 (Mumbai)

$0.02 / GB

Source: AWS EC2 On-Demand Pricing.

Worked example: S3 compliance replication to São Paulo. A fintech replicating 2 TB per month of transaction records from US-East-1 to SA-East-1 for regulatory reasons pays: 2,000 GB × $0.09 = $180 per month in transfer alone. The same replication to EU-West-1 costs 2,000 GB × $0.02 = $40 a $140/month difference driven purely by destination region. If the compliance requirement allows an EU region, the switch pays for itself with zero infrastructure change.

To and from CloudFront edge locations

Traffic from any AWS region to a CloudFront edge location is free. CloudFront then charges its own egress to the viewer, at $0.085 per GB for the first 10 TB in North America and Europe. For egress-heavy public workloads, fronting an ALB or S3 origin with a CloudFront distribution converts a $0.09 per GB charge into a $0.085 per GB charge and adds edge caching on top. Our what is CloudFront explainer covers the routing model in full.

NAT Gateway processing

Every gigabyte routed through a NAT Gateway is charged $0.045 in data processing, on top of $0.045 per hour for the gateway itself. The hourly charge is fixed at around $32 per month per gateway. The per-GB charge is what blows up unexpectedly, especially when private-subnet workloads call S3, DynamoDB, or external APIs at volume. The same routing pattern is the most common cause of bill spikes covered in our guide on how to mitigate cloud cost surges in AWS.

Working example: NAT Gateway monthly cost for a typical SaaS. Three microservices in private subnets, each routing 500 GB/month through a shared NAT Gateway 1.5 TB total. Processing fee: 1,500 GB × $0.045 = $67.50. Gateway hourly: $0.045 × 730 hrs = $32.85. Internet egress on that same traffic: 1,500 GB × $0.09 = $135. Total attributable monthly cost: $235.35. Adding a VPC Gateway Endpoint for S3 eliminates the processing fee on roughly 60–70% of that volume, cutting the bill to under $90 a saving of more than $1,700 per year on a single endpoint that takes 10 minutes to deploy.

VPC interface endpoints versus Gateway endpoints

Gateway Endpoints (S3 and DynamoDB only) are free. Interface Endpoints (PrivateLink, used for almost every other AWS service) cost $0.01 per GB plus $0.01 per hour per AZ the endpoint is deployed in. For a typical three-AZ deployment, that is roughly $22 per month per endpoint before any traffic. The math still favors interface endpoints over NAT Gateway routing at most volumes.

Working example: Secrets Manager traffic via NAT vs Interface Endpoint. Scale to 500 GB/month of combined traffic to Secrets Manager, KMS and STS across 50 services.

Routing path

Processing cost

Egress cost

Fixed cost

Monthly total

NAT Gateway

500 GB × $0.045 = $22.50

500 GB × $0.09 = $45.00

$32.85 (gateway hrs)

$100.35

Interface Endpoint (3 AZs)

500 GB × $0.01 = $5.00

$0.01 × 730 × 3 = $21.90

$26.90

The Interface Endpoint saves $73.45 per month on that single service. Break-even versus NAT is roughly 70 GB/month per endpoint, a threshold most production accounts cross in under a day.

Public IPv4 address charge

AWS now charges $0.005 per hour for every public IPv4 address (attached or idle), about $3.65 per month per IP. For teams with large fleets, this adds up fast. Identifying wasted resources in cloud is a practical starting point for auditing idle EIPs and other orphaned assets.

Working example: idle Elastic IP audit. An account with 150 Elastic IPs accumulated over three years, of which 60 are unattached: 60 × $0.005 × 730 hrs = $219 per month, or $2,628 per year, for addresses attached to nothing. A monthly aws ec2 describe-addresses audit and release loop pays for the engineering time in the first month.

Direct Connect data transfer

Direct Connect outbound runs around $0.02 per GB depending on the location pair, versus $0.09 per GB to the public internet. The port-hour fee makes it a fixed-cost play. For sustained traffic above roughly 5 TB per month between on-prem and AWS, Direct Connect pays for itself.

Working example: Direct Connect break-even at 10 TB/month. A hybrid team syncing analytics data from AWS to on-prem nightly, averaging 10 TB/month outbound.

Path

Transfer cost

Fixed cost

Monthly total

Public internet

10,000 GB × $0.09 = $900

$900

Direct Connect (1 Gbps port)

10,000 GB × $0.02 = $200

~$220 port fee

$420

Monthly saving: $480. Annual saving: $5,760. For teams evaluating whether to commit to reserved capacity, the AWS savings plans vs reserved instances comparison covers the financial model in depth.

AWS VPC peering data transfer costs

VPC peering inside a single AWS VPC region is free for the peering connection itself, but the cross-AZ rule still applies: traffic between peered VPCs in different AZs is billed $0.01 per GB each direction. Inter-region peering is billed at the inter-region data transfer rate (typically $0.02 per GB) plus the standard cross-AZ charges if applicable.

The trap most teams hit: a peering connection between two VPCs in different AZs is billed on both sides. A 1 TB transfer from VPC-A in us-east-1a to VPC-B in us-east-1b shows up as 1 TB of egress on the source account and 1 TB of ingress (also billed) on the destination, even though the data only moved once.

"0.02$ per GB since each transferred gigabyte counted as 2GB on the bill: once for sending and second for receiving."

Devora Roth Goldshmidt, Medium

Peering beats Transit Gateway on cost when you have a small number of VPC pairs in the same region. Transit Gateway adds a $0.05 per attachment-hour fee plus $0.02 per GB processed. Above roughly five peered VPCs or any inter-region mesh, Transit Gateway wins on operational simplicity, but the per-GB processing charge needs to be in the model. VPC Flow Logs are the fastest way to diagnose which peering connections are generating unexpected cross-AZ charges the VPC Flow Logs guide walks through setting up targeted logging without blowing up your CloudWatch bill.

6 hidden AWS data transfer charges that surprise teams

1. NAT Gateway processing on S3 calls

Geocodio's incident is the canonical case:

"20,167.32 GB of 'NAT Gateway' data transfers in a single day, which amounted to $907.53."

"S3 transfers still go through the NAT Gateway by default. Even though you're making requests to an AWS service that's in the same region, the traffic is routed out through your NAT Gateway and back in, incurring data transfer charges at $0.045 per GB."

Mathias Hansen, Geocodio

The fix is a VPC Gateway Endpoint for S3. It is free, takes ten minutes to deploy and routes the traffic over the AWS backbone instead of through the NAT. At 20,000 GB/day, that is $900/day in avoidable processing fees $27,000/month on a service that should cost nothing to route.

2. Cross-AZ traffic in highly available architectures

"the most expensive service, the one that takes 25% of the cost, is cross-AZ data transfer."

Devora Roth Goldshmidt, Medium

Twenty-five percent of the total cloud bill on a single line item. EKS pods, Kafka consumers and microservice meshes are the usual culprits. Topology-aware routing, zone-affinity for stateful services and Kafka rack-awareness all bend this curve down. The container cost management tools page goes deeper on the EKS specifics.

3. VPC peering counted twice

A peering connection between two AZs charges $0.01 per GB on the source and $0.01 per GB on the destination. A naive read of the docs makes it look like $0.01 per GB total. It is not.

Worked example: microservices platform with 8 peered VPCs. A platform team peering 8 service VPCs across two AZs, each pair exchanging 200 GB/month. Naive assumption: 8 pairs × 200 GB × $0.01 = $16/month. Actual bill: 8 × 200 GB × $0.02 (both sides) = $32/month. Scale that to 2 TB per pair at a larger org and the assumption costs $160/month in unbudgeted spend. Surfacing hidden cloud costs covers the audit workflow for finding these double-billed transfers in the CUR.

4. S3 cross-region replication on whole buckets

S3 Cross-Region Replication bills the inter-region data transfer rate on every replicated object, plus the standard PUT request and storage costs at the destination. Replicating a 10 TB bucket from us-east-1 to eu-west-1 costs $200 in transfer alone, before any storage. The destination-side storage adds another layer on top see our Amazon S3 storage costs breakdown. Filter replication rules by prefix or tag to avoid replicating logs and temp files.

Working example: unfiltered vs filtered S3 CRR. A compliance team replicating an entire 15 TB S3 bucket daily (logs: 8 TB, application data: 7 TB). Full replication: 15,000 GB × $0.02 = $300/month. After adding a prefix filter that excludes /logs/: 7,000 GB × $0.02 = $140/month. Annual saving: $1,920 from a two-line replication rule change.

5. Lambda in private subnet calling external APIs

A Lambda function in a private subnet that calls a third-party API egresses through a NAT Gateway. The NAT processing fee ($0.045 / GB) stacks on top of the internet egress fee ($0.09 / GB), for an effective $0.135 / GB. At any meaningful API call volume, this is the single most expensive way to leave AWS. For serverless architectures, the FinOps for serverless guide examines how to model these costs before they reach production.

Working example: Lambda enrichment function at scale. A data pipeline Lambda invoked 5 million times per day, each call making one external API request with a 10 KB response 50 GB/day inbound (free) and 5 GB/day outbound through the NAT. NAT processing (outbound): 5 GB × $0.045 = $0.225/day. Internet egress (outbound): 5 GB × $0.09 = $0.45/day. Inbound response processing: 50 GB × $0.045 = $2.25/day. Total monthly: $87.75. Moving the function outside a VPC eliminates the NAT fees entirely: monthly cost drops to $13.50 an 85 percent reduction.

6. High-cardinality monitoring metrics across AZs

"DevOps teams often focus on scaling down EC2 instances or switching to S3 Intelligent-Tiering but overlook how much data is moving between services, regions, or AZs."

PayU Engineering

PayU reported a 50 percent reduction in monitoring-related transfer costs after pruning high-cardinality Istio metrics and lengthening scrape intervals. Amnic flags this pattern in the CUR by default, so the spike is visible the day it starts, not at month end. Tracking the right FinOps KPIs including transfer cost per service as a unit metric is what makes these patterns visible before they compound.

A worked example: what does 10 TB per month actually cost?

A mid-size SaaS running a multi-AZ EKS cluster, a NAT Gateway for outbound and one cross-region replica:

Component

Volume

Rate

Cost

Internet egress

10 TB

$0.09 / GB

$900

Cross-AZ (EKS pod-to-pod)

5 TB

$0.02 / GB (round trip)

$100

NAT Gateway processing

3 TB

$0.045 / GB

$135

NAT Gateway hours (2 gateways, 730 hrs each)

1,460 hrs

$0.045 / hr

$66

S3 inter-region replication

2 TB

$0.02 / GB

$40

Total



$1,241

Now apply three changes: deploy a VPC Gateway Endpoint for S3 (eliminates 2 TB of NAT processing), enable zone-affinity routing in the service mesh (cuts cross-AZ by 60 percent) and front the public API with CloudFront. A 30 percent cache hit ratio cuts origin egress from 10 TB to 7 TB.

Component

New cost

Origin egress (7 TB at $0.09 per GB)

$630

CloudFront edge to viewer (3 TB cached, at $0.085 per GB)

$255

Cross-AZ (2 TB at $0.02 per GB round trip)

$40

NAT Gateway processing (1 TB at $0.045 per GB)

$45

NAT Gateway hours (2 gateways)

$66

S3 inter-region replication

$40

Total

$1,076

A 13 percent reduction from three architectural changes, no code rewrites. The real lever for egress-heavy workloads is the cache hit ratio: at 70 percent cache hit, origin egress falls to 3 TB and total cost drops below $700. For budgeting the impact of these changes across quarters, the cloud budgeting strategies guide covers how to model transfer cost reduction as a planned saving in your cloud budget.

9 proven ways to reduce AWS data transfer costs

1. Use VPC Gateway Endpoints for S3 and DynamoDB

Free. No hourly fee, no per-GB charge. Every byte of S3 or DynamoDB traffic from a private subnet that currently routes through your NAT Gateway is being billed $0.045 / GB for no reason. The Geocodio incident above turned into a $300 / month permanent saving the moment they added the endpoint. If you operate any private-subnet workload that talks to S3, this is the first thing to ship.

2. Co-locate services in the same Availability Zone

Zone-affinity routing in Kubernetes (topology-aware hints), zone-pinned consumer groups in Kafka and same-AZ database readers all reduce the cross-AZ bill. A service mesh that prefers same-zone endpoints can cut cross-AZ traffic by 60 to 80 percent. The tradeoff is reduced resilience if an AZ fails. The challenges of Kubernetes cost management guide examines the scheduling trade-offs in depth.

Working example: zone-affinity in a service mesh. A 30-microservice EKS cluster across 3 AZs, averaging 500 TB/month of cross-AZ service-to-service traffic. Current cost: 500,000 GB × $0.02/GB round-trip = $10,000/month. After enabling topology-aware hints in Kubernetes (80% reduction): 100 TB × $0.02/GB = $2,000/month. Monthly saving: $8,000. Engineering time to implement: one sprint to add topologyKey: topology.kubernetes.io/zone hints to each service manifest.

3. Put CloudFront in front of egress-heavy workloads

CloudFront's $0.085 / GB rate is cheaper than EC2 egress and the cache hit ratio reduces origin traffic on top. Teams we work with routinely report several hundred dollars per month in savings on 10 TB workloads after fronting an ALB or S3 origin with a CloudFront distribution.

Working example: SaaS dashboard with cacheable API responses. A team serving 20 TB/month of JSON dashboard responses. Without CloudFront: 20,000 GB × $0.09 = $1,800/month. With CloudFront at 50 percent cache hit ratio: origin sees 10 TB ($900) + CloudFront delivers 10 TB cached at $0.085 = $850. Total: $1,750. At 70 percent cache hit: origin 6 TB ($540) + CloudFront 14 TB ($1,190) = $1,730 and origin infrastructure scales down proportionally.

4. Replace NAT Gateway with VPC interface endpoints

For private-subnet traffic to AWS services that do not have a Gateway Endpoint (Secrets Manager, KMS, SQS, SNS, ECR, STS), an Interface Endpoint at $0.01 / GB is cheaper than NAT Gateway at $0.045 / GB plus internet egress. The break-even point is roughly 70 GB per month per endpoint, which most production accounts exceed in a day.

5. Use Direct Connect for high-volume on-prem to AWS traffic

At $0.02 / GB outbound versus $0.09 / GB to the public internet, Direct Connect pays for the port fee at around 5 TB per month of sustained traffic. Hybrid architectures with regular database replication, backup egress, or analytics syncing should model this against site-to-site VPN. The cloud infrastructure savings guide covers the full cost model for hybrid connectivity decisions.

6. Compress and cache responses before egress

Gzip or Brotli compression on API responses typically reduces payload size by 60 to 80 percent. Every gigabyte not transferred is a gigabyte not billed at $0.09. ETags and Cache-Control headers prevent repeat egress for unchanged resources. This is a config-only change in most frameworks.

Working example: Brotli compression on a REST API. A payments API serving 5 TB/month of JSON responses. Average JSON payload: 8 KB uncompressed, 1.8 KB after Brotli (77.5 percent reduction). Effective egress: 5 TB × 0.225 = 1.125 TB. Monthly saving: (5,000 − 1,125) GB × $0.09 = $348.75. Annual saving: $4,185. Configuration change in nginx or ALB: under an hour.

7. Use private IPs or IPv6 instead of public IPv4 where possible

The public IPv4 charge ($0.005 / hr per address) adds up across large fleets. Internal service-to-service traffic should use private IPs. IPv6 traffic is not subject to the IPv4 address fee. Audit Elastic IPs monthly and release unattached ones.

8. Right-size monitoring

Prometheus scrape intervals of 15 seconds across thousands of targets generate enormous cross-AZ traffic. Bumping to 30 or 60 seconds where appropriate, dropping high-cardinality labels from Istio metrics and aggregating before shipping to long-term storage all reduce the bill. PayU cut monitoring-related transfer costs in half using this approach. Cloud cost forecasting tools can model the projected savings before you commit to the configuration change.

9. Use Kafka rack-aware consumers (KIP-392)

Kafka consumers by default read from the partition leader, which may be in a different AZ. KIP-392 allows consumers to fetch from the closest in-sync replica, which is often same-AZ. For high-throughput streaming workloads, this single config change can eliminate tens of thousands of dollars per month in cross-AZ charges. If your cluster is on EKS, the tame Kubernetes cost explosions guide shows how to combine rack-awareness with node topology to minimise both cross-AZ and over-provisioning costs simultaneously.

Working example: KIP-392 on a 3-broker Kafka cluster. Three AZs, 10 TB/day of consumer reads, all currently hitting the leader in AZ-A from consumers spread across AZ-A, AZ-B and AZ-C. Two-thirds of reads are cross-AZ: 6.67 TB/day × $0.02 = $133/day = $4,000/month. After enabling client.rack and replica.selector.class=RackAwareReplicaSelector: consumers read from same-AZ replicas. Cross-AZ consumer traffic drops to near zero. Monthly saving: ~$3,900 from a two-line broker and client config change.

For broader strategy on cost reduction beyond data transfer, see our roundup of AWS cost optimization tools.

How to find your AWS data transfer costs in Cost Explorer and CUR

Filter Cost Explorer by Usage Type

In Cost Explorer, group by Usage Type and filter the list. The relevant codes:

  • DataTransfer-Out-Bytes internet egress

  • DataTransfer-Regional-Bytes cross-AZ within a region

  • DataTransfer-In-Bytes inbound (should be $0)

  • USE1-EUW1-AWS-Out-Bytes inter-region (varies by source and destination)

  • NatGateway-Bytes NAT Gateway processing

  • VpcEndpoint-Bytes Interface Endpoint traffic

Use tags for service-level allocation

Cost Explorer's default view shows transfer by region or by account, which is useless when one EKS cluster is responsible for 80 percent of cross-AZ traffic. Tag your resources (service, team, environment) and filter on those tags. Our guide on AWS cost allocation tags walks through the activation flow. EKS specifically requires the split cost allocation feature to attribute transfer to individual pods. For a deeper framework on structuring tags at scale, the tagging strategies guide covers governance, automation and enforcement patterns.

What the Cost and Usage Report shows that Cost Explorer doesn't

The CUR exposes the line_item_usage_type and line_item_operation fields, which Cost Explorer aggregates away. Querying the CUR in Athena lets you see, for example, exactly which S3 buckets are being read across regions, or which Lambda function is generating the most NAT Gateway processing. Once attribution is clean, the next decision is how to bill internal teams, covered in our chargeback vs showback guide. For teams running multi-cloud, our roundup of multi-cloud cost reporting tools compares platforms that normalise transfer line items across providers.

How Amnic helps you control AWS data transfer costs

Amnic's anomaly detection runs on every line item in the CUR, including the specific data transfer usage types that Cost Explorer hides behind aggregation. When a NAT Gateway spike like Geocodio's $907 day starts to develop, Amnic alerts on the deviation within hours, not at the end of the billing cycle. We benchmark this capability against the broader category in our cloud cost anomaly detection tools review.

The platform attributes transfer costs to services, teams and environments using your existing tags, with EKS split cost allocation built in. The recommendations engine flags the specific patterns we have walked through here: private-subnet S3 calls routed through NAT, cross-AZ traffic that would benefit from zone-affinity, idle Elastic IPs racking up the $0.005 / hr charge and unused Interface Endpoints. Engineering teams use Amnic to set guardrails (alert if NAT processing exceeds X GB per day per account) and finance teams use it to charge back data transfer cleanly to product lines.

Compare Amnic against alternatives in our FinOps tools roundup, or start a free trial to see your own data transfer breakdown in under an hour.

Frequently asked questions

Is AWS data transfer free?

Inbound is always free. The first 100 GB of outbound to the internet per month is free per account. Everything else (cross-AZ, inter-region, NAT processing, internet egress above 100 GB) is metered.

How much does AWS charge per GB for data transfer?

$0.09 / GB for the first 10 TB of internet egress per month, dropping to $0.085, $0.07 and $0.05 / GB at higher tiers. Cross-AZ is $0.02 / GB round trip. Inter-region is typically $0.02 / GB but rises to $0.09 / GB for South American destinations.

Why is my AWS NAT Gateway bill so high?

NAT Gateways charge $0.045 per GB processed plus $0.045 per hour per gateway. Private-subnet workloads calling S3, DynamoDB, or external APIs at volume can generate thousands of dollars per day. Geocodio reported $907 in a single day from misrouted S3 calls. Deploy VPC Gateway Endpoints for S3 and DynamoDB to bypass the NAT entirely.

Does cross-AZ data transfer really cost $0.02 / GB?

Effectively, yes. AWS bills $0.01 / GB on the sender and $0.01 / GB on the receiver, so every gigabyte transferred between AZs in the same region shows up twice on the bill. Last Week in AWS confirmed the documentation on this is ambiguous and the effective rate is $0.02 / GB round trip.

Is S3 cross-region replication included in data transfer costs?

Yes. CRR bills the standard inter-region data transfer rate (typically $0.02 / GB) plus PUT request fees and destination storage. Filter replication rules by prefix or tag to avoid replicating non-critical objects.

How do I check AWS data transfer costs in Cost Explorer?

Group by Usage Type and filter for codes starting with DataTransfer-, NatGateway- and VpcEndpoint-. For service-level breakdown, tag resources and group by the relevant tag key. The Cost and Usage Report exposes additional fields that Cost Explorer aggregates away.

What's the cheapest AWS region for egress?

Egress pricing is uniform across most US, EU and APAC regions at $0.09 / GB in the first tier. The exceptions are higher rates in South America, the Middle East and parts of Africa. For inter-region transfer, US-to-US pairs at $0.02 / GB are the cheapest. The cloud cost optimization guide covers region selection as part of a broader cost architecture strategy.

FinOps OS powered by context-aware AI agents.

Start with a 30-day no-cost trial.

Read-only.

No credit card.

No commitment.

Want to assess how your FinOps journey can scale?

Benchmark maturity, close governance gaps, and drive ROI in under 20 minutes

Can your engineering context keep up with the speed of AI?

Start with a 14-day Runtime Accountability Audit. Read-only access. No commitment.

No credit card · No migration · No agents

STAY AHEAD

Can your engineering context keep up with the speed of AI?

Start with a 14-day Runtime Accountability Audit. Read-only access. No commitment.

No credit card · No migration · No agents

STAY AHEAD

Can your engineering context keep up with the speed of AI?

Start with a 14-day Runtime Accountability Audit. Read-only access. No commitment.

No credit card · No migration · No agents

STAY AHEAD