Cost-optimized network architectures

Data transfer is often the hidden cost. Keep traffic private and local where you can, route AWS service traffic through endpoints instead of NAT, choose connections by volume, and let the edge serve what it can.

How data transfer is charged

• Data into AWS from the internet is free; data out to the internet is charged per GB.
• Traffic between AZs is charged in each direction; traffic within one AZ over private IP addresses is free.
• Traffic between Regions is charged, so replicate across Regions only what the design needs.
• Public IPv4 addresses, including Elastic IP addresses, are billed per hour whether or not they are attached.

NAT gateways and endpoints

• NAT gateway costs: An hourly charge plus a per-GB processing charge for every byte that passes through.
• One NAT gateway per AZ: With zonal NAT gateways, a gateway in each AZ avoids cross-AZ data charges and keeps one AZ's failure from cutting off the others. A single shared gateway saves hourly charges but adds cross-AZ traffic and a single point of failure. A regional NAT gateway spans AZs automatically.
• NAT instance: An EC2 instance doing NAT can cost less at low volume, but you manage its availability, scaling, and patching.
• Gateway endpoints: S3 and DynamoDB traffic through a gateway endpoint has no endpoint or NAT processing charge, so heavy S3 traffic from private subnets should never go through NAT.
• Interface endpoints: Billed per hour and per GB, but often cheaper than NAT for heavy traffic to one AWS service, and private.

Connections and bandwidth

• Site-to-Site VPN: Low fixed cost over the internet; add tunnels or connections for more bandwidth.
• Direct Connect: Port-hour charges plus a lower data transfer out rate. Pays off for large, steady volumes; size the port speed to the measured traffic, and use hosted connections for smaller speeds.
• Use the internet path (with TLS) when volume is low and occasional; it needs no circuit.

Routing, topology, and peering

• VPC peering: No hourly charge; you pay only for data transfer. Cheapest for a few VPCs.
• Transit Gateway: An hourly charge per attachment plus a per-GB processing charge, in exchange for simple hub-and-spoke routing among many VPCs.
• Share a VPC's subnets across accounts with AWS RAM so teams don't each pay for their own NAT gateways and endpoints.
• Route 53 alias queries to AWS resources are free, and latency or geolocation routing keeps users on nearby, cheaper paths.

Edge caching and throttling

• CloudFront serves cached content from the edge, cutting origin load and data transfer out of the Region; transfer from AWS origins to CloudFront is free.
• Global Accelerator adds an hourly fee and a data transfer premium; use it when you need its static IPs or failover, not for cacheable content.
• Throttling: API Gateway throttling and usage plans, AWS WAF rate-based rules, and SQS buffers stop runaway or abusive traffic from driving up back-end cost.

Reviewing an existing network

• Cost Explorer grouped by usage type shows NAT, inter-AZ, and inter-Region transfer; VPC Flow Logs show which flows cause it.
• Look for: S3 traffic going through NAT, chatty services split across AZs, idle Elastic IP addresses, and load balancers with no targets.