AWS Network Egress Costs

The fundamental asymmetry: ingress is free, egress costs money

AWS data transfer pricing has a simple core principle:

• Data coming into AWS from the internet: Free
• Data leaving AWS to the internet: $0.085–$0.09/GB (US regions, first 10TB/month)

This asymmetry affects every architectural decision involving data flow. Uploading 1TB of data to S3 from your office: free. Downloading that same 1TB back to your office: approximately $90.

The logic from AWS’s perspective is that you’re a customer bringing data into their platform (good for retention) vs. serving data out (consumes their network capacity). From your perspective, the lesson is that any architecture where your system sends large volumes of data back to users or to other systems outside AWS will incur significant egress charges.

Egress rates by scenario

Real cost scenario: a high-traffic API

A web API running on EC2 serves JSON responses to mobile clients. On a busy month:

• 10 million API calls
• Average response payload: 100KB
• Total egress: 10,000,000 × 0.0001GB = 1,000GB = 1TB

Egress cost: 1,000GB × $0.09 = $90/month — just in egress.

At 10TB/month of egress (a fairly busy service), that’s $900/month in data transfer charges alone. This is separate from EC2, RDS, and any other service costs.

For APIs returning large responses, consider:

• Response compression (gzip/brotli) — 60–80% reduction in payload size
• Pagination for large collections — don’t return 10,000 records when the user needs the first 20
• Caching at CloudFront — if the same data is requested repeatedly, serve it from CloudFront cache instead of hitting the origin EC2 instance

The cross-AZ cost surprise in multi-AZ architectures

Multi-AZ deployments improve availability but can introduce unexpected data transfer costs. The rule: traffic between resources in different Availability Zones within the same region costs $0.01/GB each way ($0.02/GB round-trip).

This surprises teams running Kubernetes on EKS. When pods in AZ-a call services running pods in AZ-b, every request and response traverses a cross-AZ link. For a busy microservices application with 10 services making thousands of calls to each other per second, the cross-AZ traffic can be substantial.

Practical mitigation:

• Use topology-aware routing in Kubernetes (available in EKS) to prefer routing within the same AZ when possible
• For services that primarily serve intra-cluster traffic, ensure your load balancer or service mesh has AZ affinity configured
• Check your Cost Explorer for the line item “EC2-Other: DataTransfer-Regional-Bytes” — this is the cross-AZ transfer charge

A Kubernetes cluster running 10 microservices generating 1TB/day of cross-AZ traffic would incur: 1,000GB × $0.01 × 30 days = $300/month in cross-AZ charges, purely for pod-to-pod communication.

NAT Gateway: the hidden per-GB charge

NAT Gateway is standard infrastructure for private subnet architectures — it allows instances in private subnets to reach the internet for software updates, API calls, etc. But NAT Gateway charges in two dimensions:

1. Hourly charge: $0.045/hour per NAT Gateway = $32.85/month just for having it
2. Data processing charge: $0.045/GB of data processed through the gateway

For a cluster of EC2 instances in private subnets that download packages and call external APIs:

• 100GB/month through NAT: 100 × $0.045 = $4.50 processing + $32.85 hourly = $37.35/month
• 1TB/month through NAT: 1,000 × $0.045 = $45 + $32.85 = $77.85/month

The NAT Gateway data processing charge stacks on top of the egress charge. If EC2 instances in private subnets send data to the internet:

• NAT processing: $0.045/GB
• Egress to internet: $0.09/GB
• Total: $0.135/GB

That’s 50% more than the egress rate alone. For high-egress workloads in private subnets, the architecture cost is significantly higher than it looks.

See the NAT Gateway page for configuration options and alternatives for specific use cases.

CloudFront as a cost reducer

CloudFront is typically discussed as a performance and caching service, but it also reduces egress costs for publicly-served content.

The math: if your origin (S3 or EC2) serves 10TB/month directly to the internet at $0.09/GB: 10,000GB × $0.09 = $900/month

With CloudFront in front:

• Origin fetch (S3 to CloudFront): free
• CloudFront to internet: $0.0085/GB for first 10TB
• 10,000GB × $0.0085 = $85/month

Plus CloudFront charges $0.01/10,000 HTTPS requests. For 100 million requests: $0.01 × 10,000 = $100/month

Total CloudFront cost: $185/month vs $900/month direct. $715/month saving, plus caching means the origin handles less traffic.

Even for non-cached content (APIs that return personalised responses), CloudFront’s lower egress rate saves money if your origin is in a region with high egress costs.

Inter-region transfer costs

Transferring data between AWS regions costs approximately $0.02/GB, regardless of direction. Common scenarios:

• Cross-region S3 replication: if you replicate S3 buckets for disaster recovery, the replication incurs inter-region transfer charges on the replicated data
• Multi-region active-active architectures: traffic replication between active regions costs money
• Cross-region RDS read replicas: promoting a read replica in another region first requires the replication data transfer

For disaster recovery designs, factor in replication data transfer costs. An application writing 1TB/day of new data and replicating it to another region for DR: 30 days × 1TB × $0.02/GB = 30,000GB × $0.02 = $600/month in cross-region transfer before any storage costs.

Strategies for reducing egress costs

Response compression — enable gzip or brotli compression on your API responses. JSON compresses 60–80%. This reduces egress bytes proportionally and is usually a single configuration change.

CloudFront caching — cache API responses that don’t require personalisation. A cache hit means zero egress from the origin.

Architecture review — if your application downloads large datasets from S3 for processing, process them within the same region as the S3 bucket. Downloading to a laptop for processing costs $0.09/GB; processing on an EC2 in the same region avoids the egress charge.

Endpoint routing — use VPC Gateway Endpoints for S3 and DynamoDB. Traffic from EC2 instances to S3 or DynamoDB via a Gateway Endpoint goes over the AWS private network rather than through the NAT Gateway, avoiding both the NAT processing charge and routing over the public internet.

# Check if you have an S3 gateway endpoint configured
aws ec2 describe-vpc-endpoints \
  --filters Name=service-name,Values=com.amazonaws.us-east-1.s3

If you don’t have a gateway endpoint for S3 and DynamoDB in each VPC, add one — it’s free and eliminates NAT processing charges for traffic to those services.