Data Transfer Cost Optimization
Key concepts
Data transfer pricing
Same-region vs cross-region
VPC endpoints savings
CloudFront for egress
PrivateLink costs
Overview
AWS data transfer costs can account for up to 20% of your cloud bill and are often overlooked. Understanding data transfer pricing and implementing optimization strategies is critical for cost-effective architectures and the SAA-C03 exam.
Core Concept
Data transfer costs follow a pattern: Inbound is free, outbound costs money, and private is cheaper than public. Same-AZ private transfers are free, cross-AZ costs $0.01/GB each way, and internet egress costs $0.09+/GB. VPC endpoints and CloudFront can dramatically reduce these costs.
Exam questions often present scenarios with high data transfer costs. Look for opportunities to use VPC Gateway Endpoints (free for S3/DynamoDB), CloudFront for content delivery (free origin fetch), and same-AZ placement to eliminate cross-AZ charges.
Key Concepts
Data Transfer Pricing Overview
Same-AZ Data Transfer
Using Private IP (IPv4 or IPv6)
- Within same VPC: FREE
- Within same AZ and VPC: FREE
Using Public/Elastic IP
- Same AZ: $0.01/GB in + $0.01/GB out
- Avoid public IPs for internal traffic!
Best Practice:
- Always use private IPs for internal communication
- Place tightly-coupled services in the same AZ
Cross-AZ Data Transfer
Within Same Region
- Standard: $0.01/GB in each direction ($0.02 total)
- VPC Peering (cross-AZ): $0.01/GB each direction
- VPC Peering (same-AZ): FREE
Impact Example:
- 100 TB cross-AZ per month = $2,000 in transfer costs
- Same workload in single AZ = $0
Considerations:
- Multi-AZ provides high availability
- Balance HA requirements against data transfer costs
- Minimize unnecessary cross-AZ communication
Cross-Region Data Transfer
Typical Pricing
- US East to US West: $0.02/GB
- US to Europe/Asia: $0.02/GB
- Region to same region (adjacent): $0.01-0.02/GB
S3 Cross-Region Replication
- Replication transfer: $0.02/GB (varies by region)
- Plus storage costs in destination region
Cost-Saving Strategies:
- Minimize cross-region data movement
- Use regional services when possible
- Consider data residency requirements vs. cost
Internet Egress
Tiered Pricing (per month) | Volume | Cost/GB | |--------|---------| | First 100 GB | FREE | | Up to 10 TB | $0.09 | | Next 40 TB | $0.085 | | Next 100 TB | $0.07 | | Over 150 TB | $0.05 |
Key Points:
- Ingress (data IN) is always FREE
- Egress (data OUT) to internet is charged
- Regional egress pricing varies
- CloudFront can reduce egress costs
VPC Endpoints Cost Savings
Gateway Endpoints (S3 & DynamoDB)
Pricing
- No hourly charge
- No data processing charge
- Completely FREE to use
How It Works:
- Route table entry directs traffic to endpoint
- Traffic stays on AWS private network
- No NAT Gateway required for S3/DynamoDB access
Cost Savings Example: Without Gateway Endpoint (via NAT Gateway):
- 10 TB to S3 = $450 NAT processing
- Plus NAT hourly: ~$32/month
With Gateway Endpoint:
- 10 TB to S3 = $0
Always Enable: No reason not to use for S3/DynamoDB access
Interface Endpoints (PrivateLink)
Pricing
- Hourly charge: ~$0.01/hour per AZ (~$7.30/month)
- Data processing: ~$0.01/GB
When to Use:
- Access AWS services privately (not S3/DynamoDB)
- Connect to third-party SaaS services
- Avoid NAT Gateway for specific service access
Cost Comparison (1 TB/month to a service): | Method | Monthly Cost | |--------|--------------| | NAT Gateway | $45 processing + $32 hourly = $77 | | Interface Endpoint | $10 processing + $7 hourly = $17 | | Savings | $60/month (78%) |
Multi-AZ Note:
- As of April 2022, inter-AZ data transfer for PrivateLink is FREE
- Still charged hourly per AZ endpoint
CloudFront for Data Transfer Optimization
CloudFront with S3 Origins
Data Transfer to CloudFront
- S3 to CloudFront: FREE
- ALB to CloudFront: FREE
- API Gateway to CloudFront: FREE
CloudFront to Users
- Cheaper than direct S3 egress
- Regional edge caching reduces origin fetches
- Price classes control geographic distribution
Cost Comparison (10 TB/month delivered): | Method | Cost | |--------|------| | Direct S3 internet egress | $870 | | CloudFront delivery | ~$850 | | Plus: Caching reduces origin load | Additional savings |
Additional Benefits:
- Performance improvement (edge caching)
- DDoS protection (Shield Standard included)
- Custom domain support
CloudFront Price Classes
Available Price Classes | Class | Edge Locations | Use Case | |-------|---------------|----------| | All | Global | Maximum performance | | 200 | Excludes expensive regions | Cost/performance balance | | 100 | US, Canada, Europe only | Lowest cost |
Savings Commitment
- 1 or 3-year commitment
- Up to 30% discount on CloudFront usage
- Committed minimum monthly usage
Compression Benefits:
- Enable automatic compression
- Reduces bytes transferred
- Lower costs + faster delivery
NAT Gateway Optimization
NAT Gateway vs Alternatives
| Scenario | NAT Gateway Cost | Alternative | Alternative Cost |
|---|---|---|---|
| S3 access from private subnet | $0.045/GB + hourly | S3 Gateway Endpoint | FREE |
| DynamoDB access | $0.045/GB + hourly | DynamoDB Gateway Endpoint | FREE |
| SQS/SNS/other AWS service | $0.045/GB + hourly | Interface Endpoint | $0.01/GB + hourly |
| Internet access required | $0.045/GB + hourly | NAT Gateway (unavoidable) | Same |
| Multiple AZs, heavy traffic | NAT per AZ | Shared NAT (less HA) | Reduced but risky |
# Create VPC Gateway Endpoint for S3 (FREE)
aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345678 \
--service-name com.amazonaws.us-east-1.s3 \
--route-table-ids rtb-12345678
# Create VPC Gateway Endpoint for DynamoDB (FREE)
aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345678 \
--service-name com.amazonaws.us-east-1.dynamodb \
--route-table-ids rtb-12345678
# Create Interface Endpoint for other services
aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345678 \
--vpc-endpoint-type Interface \
--service-name com.amazonaws.us-east-1.sqs \
--subnet-ids subnet-12345678 subnet-87654321Data Transfer Pricing Summary
AWS Data Transfer Pricing Reference
| Transfer Type | Cost | Notes |
|---|---|---|
| Same AZ, Private IP | FREE | Always use private IPs internally |
| Same AZ, Public IP | $0.02/GB total | Avoid for internal traffic |
| Cross-AZ, Same Region | $0.02/GB total | $0.01 each direction |
| Cross-Region | $0.01-0.02/GB | Varies by region pair |
| VPC Peering, Same AZ | FREE | Great for cross-account, same AZ |
| VPC Peering, Cross-AZ | $0.02/GB total | Same as regular cross-AZ |
| Internet Ingress | FREE | All inbound is free |
| Internet Egress | $0.09/GB | After 100 GB free tier |
| S3/DynamoDB Gateway Endpoint | FREE | No hourly, no data charge |
| Interface Endpoint | $0.01/GB + $0.01/hr | Per AZ, inter-AZ now free |
| NAT Gateway Processing | $0.045/GB | Plus hourly charges |
| CloudFront Origin Fetch | FREE | S3, ALB, API Gateway origins |
Best Practices
- Always Use Gateway Endpoints: S3 and DynamoDB Gateway Endpoints are free—always enable them
- Evaluate Interface Endpoints: For heavy AWS service usage, compare to NAT Gateway costs
- Use CloudFront for Content Delivery: Free origin fetch, cheaper egress than direct S3
- Minimize Cross-AZ Traffic: Place tightly-coupled services in the same AZ
- Use Private IPs: Never use public IPs for internal communication
- Consider CloudFront Price Classes: Use Price Class 100/200 if global coverage isn't needed
- Monitor Data Transfer Costs: Use Cost Explorer to identify high-transfer patterns
Common Exam Scenarios
Exam Scenario Decision Guide
| Scenario | Recommended Solution | Key Reasoning |
|---|---|---|
| EC2 in private subnet accessing S3, high data volume | S3 Gateway Endpoint | Free, eliminates NAT Gateway processing costs |
| Application calling AWS APIs (SQS, SNS, etc.) frequently | Interface Endpoints for each service | Cheaper than NAT Gateway per-GB processing |
| Static website with global audience | CloudFront with S3 origin | Free origin fetch, cheaper global delivery, caching |
| Cross-region disaster recovery with large data sync | S3 Cross-Region Replication | Built-in solution, but budget for transfer costs |
| Microservices communicating heavily | Same-AZ deployment when possible | Eliminate cross-AZ charges |
| High NAT Gateway costs identified | Review for Gateway/Interface Endpoint opportunities | Replace NAT with endpoints where possible |
| Multi-region application with shared data | Regional replicas vs cross-region access | Replication cost vs repeated access cost |
| Private connectivity to third-party SaaS | PrivateLink / Interface Endpoint | Secure, no internet egress |
Common Pitfalls
NAT Gateway Data Processing Charges
NAT Gateway charges $0.045/GB for all data processed—in ADDITION to hourly charges. Accessing S3 or DynamoDB through NAT Gateway when Gateway Endpoints (free) exist is a common and expensive mistake.
Public IP Internal Communication
Using public or Elastic IPs for communication between resources in the same VPC incurs $0.01/GB in each direction. Always use private IPs for internal traffic—it's free within the same AZ.
Unnecessary Cross-AZ Traffic
Cross-AZ traffic costs $0.01/GB each direction. Placing frequently-communicating services in different AZs without HA requirements wastes money. Balance availability needs against costs.
Interface Endpoint Per-AZ Charges
Interface Endpoints charge hourly PER Availability Zone. Creating endpoints in 3 AZs = 3x the hourly cost. Only deploy in AZs where the service is actually needed.
Forgetting CloudFront Price Classes
CloudFront's default Price Class "All" includes expensive regions. For US/Europe-focused applications, Price Class 100 or 200 can significantly reduce costs without impacting primary users.
Related Services
Quick Reference
Data Transfer Cost Quick Guide
| From | To | Cost |
|---|---|---|
| Internet | AWS | FREE |
| AWS | Internet | $0.09/GB (after 100 GB free) |
| Same AZ (private IP) | Same AZ | FREE |
| Cross-AZ | Cross-AZ | $0.02/GB total |
| S3/DynamoDB via Gateway Endpoint | EC2 | FREE |
| AWS Service via Interface Endpoint | EC2 | $0.01/GB |
| S3/ALB | CloudFront | FREE |
Key CLI Commands
# List VPC Endpoints
aws ec2 describe-vpc-endpoints --query 'VpcEndpoints[*].[VpcEndpointId,ServiceName,VpcEndpointType]'
# Create S3 Gateway Endpoint
aws ec2 create-vpc-endpoint \
--vpc-id VPC_ID \
--service-name com.amazonaws.REGION.s3 \
--route-table-ids RTB_ID
# Check NAT Gateway data processed (CloudWatch)
aws cloudwatch get-metric-statistics \
--namespace AWS/NATGateway \
--metric-name BytesOutToDestination \
--dimensions Name=NatGatewayId,Value=NAT_GW_ID \
--start-time 2024-01-01T00:00:00Z \
--end-time 2024-01-31T23:59:59Z \
--period 2592000 \
--statistics Sum
Cost Estimation Formula
Monthly NAT Gateway Cost =
(Hours × $0.045) + (GB processed × $0.045)
Monthly Interface Endpoint Cost =
(Endpoints × AZs × Hours × $0.01) + (GB processed × $0.01)
Potential Savings with Gateway Endpoints =
NAT Gateway Cost for S3/DynamoDB traffic → $0
Test Your Knowledge
A company's AWS bill shows $5,000/month in NAT Gateway data processing charges. Analysis shows 80% of the traffic is to Amazon S3. What is the MOST cost-effective solution?
An application has web servers in us-east-1a and us-east-1b that communicate frequently with a shared Redis ElastiCache cluster. The architect notices high cross-AZ data transfer charges. What should they consider?
A media company serves video content directly from S3 to users worldwide. Their data transfer costs are $50,000/month. Which solution would provide the GREATEST cost reduction?
A SaaS application in a private subnet needs to call AWS SQS and SNS APIs frequently (processing 5 TB/month). Currently using NAT Gateway. What is the MOST cost-effective alternative?