Reducing data transfer costs means changing the path the bytes take: keep traffic within one zone where availability allows, reach provider services through free endpoints rather than a NAT gateway, send outbound traffic through a CDN with caching and compression, and keep data where it is processed. Because data transfer is priced by the network boundary it crosses, the path is the lever; the boundaries and their prices are covered in data transfer and egress. Before any lever applies, it has to be clear which traffic crosses which boundary and who causes it.
How it works
Finding the traffic
- Split by usage type, meter or SKU. AWS Cost Explorer offers usage type groups such as "EC2: Data Transfer - Inter AZ" and "EC2: Data Transfer - Region to Region". Azure names the kind of traffic in
MeterCategory,MeterNameandMeterRegion. Google names SKUs such as "Network Inter Zone Data Transfer Out"; since 15 December 2023 they say "data transfer" instead of "egress". - Assign each line a boundary: zone, region, internet, gateway or endpoint, CDN.
- Find the sources. Transfer lines often carry no resource ID. Flow logs close the gap: AWS VPC Flow Logs capture IP traffic per network interface, with fields such as
instance-idandaz-id; Azure VNet flow logs record traffic through a virtual network, and Traffic Analytics analyses them; Google VPC Flow Logs aggregate sampled packets per connection, and Flow Analyzer breaks down, for example, traffic from zone X to zone Y down to the source address. Google charges for generating the flow logs themselves. - Choose the lever by path.
| Path | Lever | The lever's own cost |
|---|---|---|
| Between zones | Put components that talk to each other in one zone, route zone-aware | no fee, but less resilience |
| From private subnets to storage and platform services | Gateway endpoint (AWS), service endpoint (Azure), Private Google Access | no additional charge for gateway and service endpoints, according to AWS and Microsoft; Private Google Access is a subnet setting |
| Privately to other services | Interface endpoint, private endpoint, Private Service Connect | hours per endpoint, data processing per GB |
| To the internet | CDN with caching and compression | CDN prices, cache fill on misses |
| Between regions | Data and processing in the same region | migration, data residency questions |
Zones
For heavy traffic through a NAT gateway, AWS advises placing the resources in the gateway's zone or running a NAT gateway in each zone. On a Network Load Balancer, cross-zone load balancing is off by default; turning it on incurs EC2 data transfer charges. On an Application Load Balancer it is always on at the load balancer level, can be turned off per target group, and AWS charges no regional data transfer for it. In Kubernetes, Topology Aware Routing prefers endpoints in the zone the traffic came from, and the documentation names cost explicitly as one reason. Whether a component may run in a single zone is an availability decision for its owner, not a cost question alone.
Endpoints instead of NAT
Gateway endpoints for S3 and DynamoDB are attached through route tables and work only within their Region: traffic to a bucket in another Region still goes through the internet gateway. Interface endpoints charge their processing fee on every GB, whatever the source or destination, so traffic moved off a NAT gateway onto one keeps a per-GB charge. Azure charges nothing extra for service endpoints; the Private Link pricing page also lists the standard service endpoint, in public preview, with an hourly price per virtual network. Private endpoints cost per hour and per GB of inbound and outbound data processed, with data transfer on top. On Google Cloud, a Public NAT gateway never translates traffic to Google APIs; instead it turns on Private Google Access for the subnet ranges it serves. Private Service Connect costs per endpoint and hour; endpoints for the global Google APIs carry no data charge, endpoints for regional Google API endpoints and for published services one per GiB, and Google does not charge inter-zone transfer to or from an endpoint.
CDN and compression
A CDN serves cached content from its edge locations and so reduces traffic from the origin; prices and hit ratio are covered in content delivery networks. Compression reduces the bytes themselves. CloudFront compresses objects between 1,000 and 10,000,000 bytes with Gzip or Brotli when the cache policy enables it and the origin sends Content-Length. Azure Front Door compresses files between 1 KB and 8 MB with an eligible MIME type on its edge servers. Cloud CDN in AUTOMATIC mode compresses responses between 1 KiB and 10 MiB with a compressible Content-Type and a Content-Length header, provided they carry no Content-Encoding header yet and no no-transform directive.
Regions
Google recommends concentrating closely related resources that exchange data in the same region to avoid traffic between regions. The cost pillar of the AWS Well-Architected Framework covers the subject in question COST 8 with three practices: model data transfer, select components accordingly, implement services that reduce it. In the Azure Well-Architected Framework, Microsoft recommends among other things a CDN to reduce data movement, and flow logs with Traffic Analytics to find the largest sources.
What it means for your cost
A lever moves cost between lines before it lowers it. A gateway endpoint removes NAT processing for S3 and DynamoDB traffic. An interface endpoint replaces it with hours and a per-GB charge of its own, and whether that pays depends on volume, the number of zones and the hourly price. A NAT gateway per zone saves cross-zone transfer and adds hourly charges (load balancers, NAT gateways and public IP addresses). Proof therefore comes from all affected lines at once, not only from the one that was meant to fall.
Because transfer lines hang on the path rather than on the resource that causes them, assigning them to teams takes the flow log analysis or a rule; without either, network traffic ends up in shared cost.
Where it goes wrong
- An endpoint in the wrong Region. Symptom: NAT or internet traffic to S3 continues after the gateway endpoint is set up. Cause: the bucket sits in another Region, and gateway endpoints work only in their own.
- Cross-zone load balancing switched on. Symptom: after a change to a Network Load Balancer, transfer between zones grows. Cause: cross-zone load balancing on an NLB incurs EC2 data transfer charges.
- One NAT gateway for all zones. Symptom: transfer between zones grows with outbound traffic. Cause: instances in other zones reach the gateway across the zone boundary.
- Compression does not apply. Symptom: the bytes delivered do not change after switching it on. Cause: the response is outside the size limits, already carries
Content-Encodingorno-transform, or the origin sends noContent-Length(CloudFront, Cloud CDN). - Private endpoints taken as free. Symptom: a new Private Link line grows with storage traffic. Cause: Azure charges private endpoints per hour and per GB processed in both directions.
- A query on the old SKU name. Symptom: an analysis over several years shows no more egress from late 2023. Cause: Google replaced "egress" with "data transfer" in its SKU descriptions.
Sources
Read on 2026-10-16. AWS gateway endpoints, gateway endpoints for Amazon S3, AWS PrivateLink pricing, NAT gateway pricing, Application Load Balancer target group attributes, Elastic Load Balancing FAQs, Network Load Balancer target group attributes, serving compressed files with CloudFront, VPC Flow Logs and flow log records, filtering in Cost Explorer and Well-Architected COST 8; Microsoft virtual network service endpoints, Azure Private Link pricing, compression in Azure Front Door, virtual network flow logs, traffic analytics, cost details fields, optimizing data costs and optimizing flow costs; Google Cloud Cloud NAT product interactions, Private Google Access, VPC network pricing, Cloud CDN dynamic compression, VPC Flow Logs, Flow Analyzer, minimize costs when migrating, SKU group Network Egress GCE and renaming egress to data transfer; Kubernetes Topology Aware Routing.