AWS data transfer pricing

AWS data transfer pricing is a price per GB at every network boundary data crosses: to the internet in four tiers by monthly volume, between regions by source and destination region, between availability zones in both directions, through a NAT gateway, an interface endpoint or a transit gateway per GB processed plus an hour, and over Direct Connect per GB plus a port hour; inbound traffic from the internet and traffic to CloudFront cost nothing. On the bill the internet tiers rarely dominate although they carry the highest price per GB; the NAT gateway and the traffic between availability zones do, because both accrue on traffic that never leaves the AWS network.

Pricing dimensions

Data transfer is not a service but a dimension every service brings along: the line sits under the product code of the service that sent the data, and the usage type names the boundary. What counts is the direction, the source and the destination, not the content.

The internet tiers apply to the monthly volume of the account or organisation across all services and regions together, so an account with a lot of S3 egress pays its EC2 egress in the cheaper tier too; the 100 GB free allowance a month is global and does not apply per region or service. The price per GB falls with volume but stays, even in the highest tier, above what a month of storage of the same GB costs in S3. Between regions only the sending side pays, and the price depends on the pair; within Europe and to North America it sits well below the internet price in Frankfurt.

Traffic between availability zones is the least understood dimension: it accrues as soon as an instance in one zone talks to a resource in another, and on both sides, so every GB appears twice in the data. High availability produces it systematically, because load balancers spread across zones, databases replicate into a second zone and Kubernetes pods run on nodes in different zones. The NAT gateway is the second: it charges per GB processed, in every direction, also for traffic to S3, DynamoDB or other AWS services of the same region that would be free through a gateway endpoint and cheaper through an interface endpoint; the mechanics across all three providers are in data transfer and egress.

How it appears in your billing data

In the Cost and Usage Report, data transfer sits under the product code of the service that sent, that is AmazonEC2, AmazonS3, AmazonRDS or AWSLambda, with lineItem/Operation as the service assigns it, and the usage type names the boundary; the prefix is the region code, EUC1 for Frankfurt. To the internet appears as EUC1-DataTransfer-Out-Bytes with the tiers as separate lines, from the internet as EUC1-DataTransfer-In-Bytes at 0, between zones as EUC1-DataTransfer-Regional-Bytes with one line each on the sending and the receiving resource. Between regions there are two lines: EUC1-EUW2-AWS-Out-Bytes on the source in Frankfurt with the price and EUW2-EUC1-AWS-In-Bytes on the destination in London at 0; the order of the codes names source and destination. Traffic to CloudFront appears as EUC1-CloudFront-Out-Bytes at 0.

The gateways have usage types of their own under AmazonEC2 or AmazonVPC: EUC1-NatGateway-Hours and EUC1-NatGateway-Bytes for the NAT gateway, EUC1-VpcEndpoint-Hours and EUC1-VpcEndpoint-Bytes for interface endpoints, EUC1-TransitGateway-Hours and EUC1-TransitGateway-Bytes with the operation TransitGatewayVPC, TransitGatewayVPN or TransitGatewayDirectConnect by attachment type, EUC1-VpcPeering-Out-Bytes and EUC1-VpcPeering-In-Bytes for peering. Direct Connect sits under AWSDirectConnect as EUC1-EqFA5-PortUsage:10G with the location code in the name and as DataTransfer-Out-Bytes with the location for the traffic out. The 100 GB free allowance appears as a line of its own at 0 across all regions, which is why an account's egress in the report is spread over several regions and services and only the sum over DataTransfer-Out-Bytes explains the tier.

What the report does not show is who talked to whom: lineItem/ResourceId names the instance, the volume or the bucket, not the destination. Which connection crosses the zone boundary shows only in VPC Flow Logs with the fields for source and destination address and the zone IDs of the two subnets. Cost Explorer sums DataTransfer-Regional-Bytes, NatGateway-Bytes and the IPv4 addresses under EC2-Other; to separate them, group by usage type. The report's structure is described in the AWS Cost and Usage Report. In the FOCUS export, data transfer stays with the sending service in ServiceName and is ChargeCategory Usage; the boundary sits only in x_UsageType (FOCUS columns).

Levers

Configuration: the gateway endpoint for S3 and DynamoDB is the first lever, because it replaces the NAT traffic to both services free of charge; the interface endpoint for services with a lot of traffic from private subnets the second, because its hour and its GB price sit below the NAT gateway's as soon as more than a few hundred GB a month flow. The choice of zone is the third: traffic that stays within a zone costs nothing, and topology-aware routing in Kubernetes, zone-local caches and read replicas in the same zone as the reader keep it there; the method is in data transfer optimisation.

Purchase option: there is no reservation and no Savings Plan for data transfer; from several hundred TB a month customers negotiate rates of their own as part of an enterprise agreement. Customers in the EU can request reduced rates for eligible cases under the Data Act, which AWS names on its pricing page and support handles; what the law requires is described in the Data Act and switching charges.

Architecture: CloudFront in front of everything served to the internet, because transfer to CloudFront is free and CloudFront has free allowances of its own and lower tiers. Cross-region replication only where a requirement demands it, and compression before every boundary, because every boundary counts per GB. Direct Connect instead of the internet for traffic into a data centre as soon as the volume justifies the port hours, because the GB price over Direct Connect is a fraction of the internet price.

Where it goes wrong

• The NAT gateway pays for S3. Instances in private subnets write backups to S3 through the NAT gateway, which charges every GB. Lines with NatGateway-Bytes beside S3 uploads are the clue; a gateway endpoint ends them (NAT gateway).
• The zone boundary costs twice. A load balancer in three zones spreads to targets in three zones, and every GB appears twice as DataTransfer-Regional-Bytes. Zone-aware routing and targets in the caller's zone halve or end the line.
• Replication runs into the wrong region. An S3 replication or a database replica in a second region pays every GB as AWS-Out-Bytes. Check whether the requirement demands a second region or only a second zone.
• Egress sits on ten lines. Internet transfer spreads over EC2, S3, Lambda and load balancers and over regions. Only the sum over DataTransfer-Out-Bytes shows the volume and the tier.
• The public IP makes the zone dear. Traffic within a zone over a public or Elastic IP pays the zone price although both resources stand side by side. Internal calls belong on private addresses.
• The transit gateway charges every side. Every attachment pays the hour, and every GB a VPC sends to the gateway the GB price. Two VPCs with a lot of traffic are cheaper over peering.
• The endpoint is in every zone. One interface endpoint per zone and per service pays the hour per zone, even without traffic. Count the VpcEndpoint-Hours lines against the services really used.

Example

List prices in USD for Frankfurt (eu-central-1), read on 2026-10-21 from the AWS price list: transfer to the internet costs USD 0.09 per GB for the first 10 TB a month, USD 0.085 up to 50 TB, USD 0.07 up to 150 TB and USD 0.05 beyond, after 100 GB of free allowance; to another region, such as London or Northern Virginia, USD 0.02 per GB; between availability zones USD 0.01 per GB in each direction. A NAT gateway costs USD 0.052 per hour and USD 0.052 per GB, an interface endpoint USD 0.012 per hour and zone and USD 0.01 per GB up to 1 PB, a transit gateway USD 0.06 per attachment and hour and USD 0.02 per GB, VPC peering USD 0.01 per GB in each direction; a Direct Connect port costs USD 0.30 per hour at 1 Gbit/s and USD 2.25 at 10 Gbit/s at the Frankfurt locations.

An application that writes 1 TB a month from private subnets to S3 pays USD 37.96 of gateway hours and USD 53.25 for the 1,024 GB through a NAT gateway, USD 91.21 in all; through a gateway endpoint nothing. The same volume to SQS through a NAT gateway costs the same USD 91.21, through an interface endpoint in two zones USD 17.52 of hours and USD 10.24 of processing, USD 27.76 in all. A load balancer that spreads 10 TB a month to targets in other zones produces 10,240 GB × 0.02 = USD 204.80, twice the single price, because both sides pay. The same 10 TB served to the internet cost USD 912.60, 10 TB replicated into a second region USD 204.80. The figures show that the NAT gateway costs more per GB than transfer between regions, that the zone boundary costs as much as a second region at the same volume, and that the internet price per GB is more than four times that.

Sources

Read on 2026-10-21. Prices: Amazon EC2 on-demand pricing, data transfer section, Amazon VPC pricing, AWS PrivateLink pricing, AWS Transit Gateway pricing, AWS Direct Connect pricing, AWS Price List, offer AWSDataTransfer for eu-central-1, offer AmazonVPC, offer AWSDirectConnect. Billing data: understanding data transfer charges in Data Exports, codes for Amazon VPC in billing reports, FOCUS 1.0 with AWS columns. Service: overview of data transfer costs for common architectures.