AWS Data Transfer Pricing, Explained: What's Billed and What's Free
Data transfer is the least predictable item on an AWS bill. Compute and storage cost what you provision, but transfer charges depend on the path the traffic took, which decides both whether it is billed at all and at what rate. The conclusion up front: on top of the basic principle that inbound is free and outbound is paid, two legs produce most of the bill: traffic leaving to the internet (~$0.09/GB) and traffic crossing between AZs (~$0.02/GB round trip). NAT Gateway processing fees and public IPv4 charges then stack on top of the transfer itself. NAT has its own post, and the CloudFront cost case was worked out in the previous post. Prices are for us-east-1.
Rates by leg #
| Leg | Rate | Notes |
|---|---|---|
| Internet → AWS (inbound) | Free | All services |
| AWS → internet (outbound) | ~$0.09/GB (first 10TB) | 100GB/month free across services, tiers drop after |
| Within one AZ (private IP) | Free | Billed if routed via public IPs |
| Between AZs | $0.01/GB each way ($0.02 total) | Charged even within one region |
| Between regions | ~$0.02/GB (varies by pair) | Some close pairs are $0.01 |
| AWS origin → CloudFront | Free | Billed only when leaving CloudFront to the internet |
| Through a NAT Gateway | +$0.045/GB processing | Hourly fee separate; stacks on transfer |
| Public IPv4 address held | $0.005/hour | Billed for holding, not transfer |
The principle: direction and boundaries #
Two questions decide the billing: which direction, and which boundary does it cross.
Direction is simple. Traffic entering AWS is free wherever it comes from; traffic leaving AWS is what gets billed. A service that receives uploads has little to worry about; a service that pushes downloads carries transfer as a major cost of goods.
There are three boundaries, nested: AZ, region, internet. The further out the boundary, the more it costs. Traffic within one AZ over private IPs is free. Crossing an AZ boundary costs $0.01/GB each way — $0.02/GB for a round trip — even inside one region. Crossing a region boundary bills the sending side at a pair-specific rate, generally around $0.02/GB, and leaving to the internet costs about $0.09/GB for the first 10TB.
Internet egress comes with 100GB free per month across all services, and the rate steps down past 10TB to $0.085, then $0.07 and $0.05. It is still the most expensive boundary, which is why bulk content delivery defaults to CloudFront, with its lower rates and free origin leg.
Three patterns that surprise the bill #
Cross-AZ round trips. For availability, services span multiple AZs, and everything they say to each other across that boundary is billed. The usual suspects: an application reading a DB replica in another AZ, microservice calls hopping between AZs, and cross-zone load balancing. Placing chatty internal paths within one AZ erases the charge, but it trades against availability, so it is safest applied to stateless tiers only. Note that transfer bundled into a service, such as RDS Multi-AZ replication, is not billed.
S3 traffic through a NAT Gateway. When private-subnet traffic to S3 goes through NAT, it picks up the $0.045/GB processing fee. S3 and DynamoDB have free gateway VPC endpoints, so creating one makes that charge disappear entirely. Other AWS services can be reached through interface endpoints (about $0.01/hour plus $0.01/GB), which usually undercut NAT. With little traffic, the endpoint’s fixed cost can outweigh the saving, so decide on monthly volume.
Internal traffic over public IPs. Even within a region, traffic over public IPs bills at a higher rate than the private path, and each public IPv4 address itself costs $0.005/hour, about $3.6 a month. Private IPs are the default for internal traffic, and the grown IPv4 line item starts with cleaning up unused EIPs, as covered in the standing checklist.
Order of attack #
- Decompose the transfer line in Cost Explorer first: split by usage type into DataTransfer-Out, DataTransfer-Regional, and NatGateway-Bytes, and the dominant leg shows itself immediately.
- If internet egress dominates, evaluate CloudFront: cacheable content wins three ways, with lower rates, a free origin leg, and the always-free 1TB.
- If NAT processing dominates, create endpoints: the S3 and DynamoDB gateway endpoints are free, so there is no reason not to. Compare interface endpoint fixed costs for the rest.
- Treat cross-AZ traffic path by path: consider same-AZ placement or compression for high-volume internal paths, without trading away the availability the architecture needs.
- Replicate only what you need across regions: S3 cross-region replication and DR pipelines cut transfer directly when scoped by prefix and filter rather than whole buckets.
Summary #
- Inbound is free, outbound is billed. The boundaries are AZ, region, and internet, and each step outward costs more.
- Internet egress at ~$0.09/GB is the most expensive leg. Bulk delivery goes through CloudFront for lower rates and a free origin leg.
- Cross-AZ is $0.01/GB each way, $0.02 round trip. Internal chatter in a multi-AZ architecture is the item that grows quietly.
- NAT processing and public IPv4 charges stack on top of transfer. Free gateway endpoints for S3 and DynamoDB bypass NAT entirely.
- Savings start with the usage-type breakdown in Cost Explorer. Until you know which leg dominates, no fix can be verified.