Network costs
Data transfer is the part of the bill that architecture decides: where traffic crosses AZs, Regions, NAT and the internet. This is Domain 4: Design Cost-Optimized Architectures, 20% of the scored content.
In AWS you pay mostly for data going out and across boundaries. Every AZ, Region or internet hop on the path can add a charge.
Key points
- Inbound: data from the internet into AWS is free.
- Internet egress: billed per GB, with the first 100 GB per month free, aggregated across services and Regions.
- Between AZs: billed in both directions, for example $0.01 per GB in and out over VPC peering. Chatty tiers spread across AZs pay on every call.
- Between Regions: billed on the sending Region, the receiving side is free. Cross-Region replication always carries this cost.
- S3 in the same Region: transfer from S3 to other AWS services in the same Region, and from S3 to CloudFront, is free.
- Public IPv4: every public IPv4 address, in use or idle, costs $0.005 per hour.
On the exam
"Cut transfer cost between the app tier and the database" -> keep chatty components in the same AZ where availability allows, or cache. Cross-Region replication only pays off when DR or latency requires it.
What it costs to move a GB
| Path | Charge |
|---|---|
| Internet to AWS | Free. |
| AWS to internet | Per GB, first 100 GB per month free across all services. |
| Same AZ over VPC peering | Free since May 2021. |
| Across AZs | Per GB in each direction. |
| Across Regions | Per GB on the source Region, inbound free. |
| S3 to CloudFront | Free. |
| Through a NAT gateway | Per GB processing fee on top of data transfer. |
NAT gateways
NAT gateways and NAT instances
A NAT gateway bills per hour and per GB processed, so heavy outbound traffic, or traffic to AWS services sent through NAT, gets expensive.
Key points
- Charges: an hourly fee plus a per-GB processing fee whatever the destination, for example $0.045 per hour and $0.045 per GB in US East (Ohio), plus normal data transfer.
- One per AZ vs shared: a zonal NAT gateway in each AZ survives an AZ failure and avoids cross-AZ charges. One shared gateway saves hours but is a single point of failure and adds inter-AZ transfer.
- Regional NAT gateway: one gateway ID that expands to every AZ with workloads, billed per AZ hour, with no public subnet needed. It does not support private NAT.
- NAT instance: you pay only for the instance, with no processing fee, but you manage failover, patching and sizing, and bandwidth depends on the instance type. AWS recommends NAT gateways.
- Avoid NAT for AWS services: gateway endpoints for S3 and DynamoDB, interface endpoints for other services.
On the exam
"Production, must survive an AZ failure" -> one NAT gateway per AZ or a regional NAT gateway. "Dev VPC, minimize cost" -> one shared NAT gateway. "Large NAT bill caused by S3 traffic" -> S3 gateway endpoint.
VPC endpoints
Gateway and interface VPC endpoints
Endpoints keep traffic to AWS services off the NAT gateway and the internet. Gateway endpoints are free, interface endpoints are not.
Key points
- Gateway endpoints: S3 and DynamoDB only, a target in the route table, with no hourly or processing charge.
- Interface endpoints: an ENI per AZ through PrivateLink, billed per hour per AZ plus per GB processed, for example $0.01 per hour and $0.01 per GB for the first PB.
- Reach: a gateway endpoint serves only its own VPC and Region. Resources in a peered VPC cannot use it.
- Break-even: an interface endpoint pays off when the NAT processing it replaces costs more than its hours and per-GB fee.
On the exam
"Private instances push TBs to S3 through NAT, cut cost" -> S3 gateway endpoint. An interface endpoint for S3 is the distractor here, it bills per hour and per GB.
CloudFront
Amazon CloudFront
Caching at the edge cuts origin load and origin egress. Fewer requests reach EC2 or S3, so the origin can be smaller and transfers less.
Key points
- S3 to CloudFront: free, so you pay CloudFront delivery instead of S3 internet egress.
- Cache hit ratio: longer TTLs and fewer cache key values mean fewer origin fetches and smaller origins.
- Price class: set the maximum price you want to pay, serving from fewer edge Regions, at the cost of latency for distant viewers.
- Flat-rate plans: monthly plans with no overage charges, from a Free plan with 100 GB upward. Blocked DDoS attacks and WAF-blocked requests do not count against the allowance.
- vs Global Accelerator: CloudFront caches HTTP content, Global Accelerator does not cache.
On the exam
"Global users download the same static files, reduce cost and latency" -> CloudFront in front of S3. Bigger instances or replicating buckets to more Regions are the distractors.
Direct Connect vs VPN
AWS Direct Connect and AWS Site-to-Site VPN
The cheapest link depends on volume and bandwidth. VPN rides the internet and is quick to set up. Direct Connect bills port hours but lowers per-GB egress and gives consistent bandwidth.
Key points
- Site-to-Site VPN: billed per connection hour plus normal data transfer out. Up to 1.25 Gbps per standard tunnel and up to 5 Gbps per large bandwidth tunnel.
- Scaling VPN: ECMP across several tunnels on a transit gateway, with dynamic routing, aggregates bandwidth.
- Direct Connect: port hours are billed even with no traffic, data in is free, data out has its own lower rate, for example $0.02 per GB from US East (Ohio) to Columbus.
- Port speeds: dedicated 1, 10, 100 and 400 Gbps, hosted from 50 Mbps to 25 Gbps through partners. Pick the smallest port that meets the peak.
On the exam
"Moves tens of TB per month to on premises, needs consistent throughput" -> Direct Connect. "Connect a branch within days, low volume" -> Site-to-Site VPN. "Need more than 1.25 Gbps over VPN" -> several tunnels with ECMP on a transit gateway.
Choosing the link
| Link | Cheapest fit |
|---|---|
| Internet | Low volume, no private connectivity requirement. Only data transfer out. |
| Site-to-Site VPN | Encrypted private access set up quickly, moderate volume, up to 1.25 Gbps per tunnel. |
| Direct Connect hosted | 50 Mbps to 25 Gbps through a partner, steady traffic. |
| Direct Connect dedicated | 1 to 400 Gbps, large steady volumes where the port hours pay off. |
Transit Gateway vs peering
AWS Transit Gateway and VPC peering
Peering is the cheaper path for a few VPCs. Transit Gateway adds a per-attachment and per-GB fee in exchange for hub-and-spoke routing at scale.
Key points
- VPC peering: no charge to create, data transfer within the same AZ is free and across AZs or Regions is billed. Not transitive and no overlapping CIDRs.
- Transit Gateway: billed per attachment hour and per GB sent into it, for example $0.05 per VPC attachment hour and $0.02 per GB in US East (Ohio). Data from a peering attachment has no processing fee.
- Scale: AWS recommends Transit Gateway or PrivateLink to connect hundreds or thousands of VPCs.
- Shared hybrid link: one VPN or Direct Connect attachment on the transit gateway serves every attached VPC.
On the exam
"3 VPCs exchanging heavy traffic, lowest cost" -> VPC peering. "200 VPCs plus on premises, central routing" -> Transit Gateway.
Global Accelerator
AWS Global Accelerator
Brings user traffic onto the AWS global network through 2 static anycast IPv4 addresses. It buys performance and availability, it does not reduce transfer cost.
Key points
- Fixed fee: $0.025 per hour per accelerator, charged even while it is disabled.
- DT-Premium: per GB on the dominant traffic direction, on top of standard data transfer out.
- Fit: static IPs, fast failover between Regions, endpoints such as NLB, ALB, EC2 or Elastic IPs. No caching.
- Cost lever: pay for it only when the requirement is performance or static IPs. For cacheable HTTP content, CloudFront lowers origin cost instead.
On the exam
"Game over UDP, static IPs, fast failover between Regions" -> Global Accelerator. "Reduce the cost of serving static content" -> CloudFront, not Global Accelerator.
API Gateway levers
Amazon API Gateway
Throttling and caching keep the backend from paying for traffic it does not need to serve.
Key points
- Throttling: limits per Region and account, per stage and method, and per client through usage plans. Excess requests get
429 Too Many Requests. - Usage plans: API keys with rate, burst and quotas per client. Throttles and quotas are best effort targets, not hard ceilings.
- Caching: REST API stage cache with a TTL of 300 seconds by default and up to 3600, only
GETcached by default. Fewer calls reach Lambda or the database. - Cache cost: billed per hour by cache size and not in the Free Tier, so it pays off only with a good hit rate.
On the exam
"The same reads hit Lambda and DynamoDB over and over" -> API Gateway caching. "Limit a partner to 1,000 requests per day" -> usage plan quota with an API key.