Cost Optimized Networking

What it is

Network cost is mostly data transfer. It is easy to overlook, because it appears as many small line items rather than one big resource.

The general pattern is simple to remember.

Data coming into AWS from the internet is generally not charged, while data going out to the internet is charged. Traffic between Regions is charged, and so is traffic between Availability Zones. Traffic that stays inside one AZ over private IP addresses is usually the cheapest.

How it works

Where the charges come from

Because exact rates change by Region and over time, the exam asks about the pattern, not the number. Use the Pricing Calculator for real estimates.

NAT gateway versus endpoints

A NAT gateway charges an hourly amount and a per GB processing fee for all traffic that passes through it. If private instances move lots of data to Amazon S3 or DynamoDB through a NAT gateway, you pay that processing fee on every byte.

A gateway VPC endpoint for S3 or DynamoDB has no hourly charge and no data processing charge, and it keeps traffic off the internet. This is one of the most common cost answers on the exam. Interface endpoints (PrivateLink) do charge an hourly fee and a processing fee, but they keep traffic private and are the option for services that have no gateway endpoint.

For NAT gateways, one per AZ is more resilient but costs more, and cross AZ traffic to a single NAT gateway adds transfer charges. Weigh resilience against cost, and remember that a development environment may need only one. A self managed NAT instance can cost less for very light traffic, but you must patch it and it is a single point of failure.

CloudFront and caching

Serving content through CloudFront can lower cost, because data transfer from CloudFront to users is often priced lower than transfer out directly from the origin, and fewer requests reach the origin. Data moving from an AWS origin, such as S3 or an Application Load Balancer, to CloudFront is not charged as data transfer out of that origin. CloudFront price classes let you serve only from lower priced edge locations if you accept slightly higher latency for some users.

Caching also cuts compute and database load. A higher cache hit ratio means less origin traffic and lower cost.

Hybrid connectivity cost

Site to Site VPN is cheap to start and priced by hour and by data transfer. Direct Connect has a port charge and lower data transfer out rates, so it becomes cost effective for large, steady volumes and also gives consistent performance. For small or temporary needs, VPN is cheaper, and for big sustained flows, Direct Connect usually wins.

Transit Gateway charges for each attachment and for data processed, so many small VPC to VPC links through a hub can cost more than a few direct peering connections. VPC peering has no hourly charge, though data transferred across AZs or Regions through it is still charged.

Size the link to the traffic, because bandwidth is part of the cost. A Site to Site VPN tunnel carries up to about 1.25 Gbps.

For more, use several VPN connections with a Transit Gateway and turn on equal cost multipath (ECMP) routing, which spreads traffic across the tunnels. A virtual private gateway does not do this.

Direct Connect dedicated connections come in 1, 10 and 100 Gbps ports.

Hosted connections come from a partner in smaller sizes, starting at 50 Mbps. Choose by steady load plus a margin for peaks. If the peak is rare, a VPN can sit alongside Direct Connect as a lower cost backup.

Design habits that reduce transfer cost

• Place chatty components in the same AZ where availability allows, for example a cache close to the application tier.
• Keep data and compute in the same Region.
• Compress and cache responses.
• Use S3 Transfer Acceleration or Multi Region designs only when the benefit justifies the extra charge.
• Delete unused Elastic IP addresses, idle NAT gateways and unused load balancers, which cost money while doing nothing.