Data Transfer and Network Costs

What it is

In a large estate, network cost is spread across many small charges: NAT gateway processing, cross AZ transfer, Transit Gateway processing, endpoint hours and inter Region transfer. Together they can rival compute spend.

The professional exam tests whether you can find the expensive path in a multi account design and replace it with a cheaper one without breaking security or availability.

How it works

The charge map

Exact rates vary by Region, so the exam asks about the pattern, not the number.

Private connectivity to AWS services

Gateway VPC endpoints exist for Amazon S3 and DynamoDB. They add a route table entry, have no hourly or processing charge, and remove NAT gateway processing for that traffic. This is the first fix when private subnets move large volumes to S3.

Interface endpoints (AWS PrivateLink) serve most other services. They charge per hour for each AZ they are deployed in and per GB processed. In a multi account estate, centralizing interface endpoints in a shared services VPC and resolving them through Route 53 can cut endpoint hours, but the traffic then crosses Transit Gateway, which adds processing charges.

AZ aware design

Cross AZ traffic is charged in both directions. Keep chatty tiers in the same AZ where availability allows, for example by routing each AZ to its own NAT gateway and preferring same AZ targets.

Place a NAT gateway in every AZ that has private workloads. One shared NAT gateway saves the hourly charge but adds cross AZ transfer and creates a single AZ dependency. For production, one per AZ is the standard answer, while a development VPC may accept one.

Cross zone load balancing on Network Load Balancers is off by default, and turning it on can add inter AZ data charges.

Centralized egress versus per VPC NAT

Centralized egress pays off with many low traffic VPCs. When a few VPCs push heavy internet traffic, local NAT gateways can cost less, because they avoid the Transit Gateway processing charge.

Transit Gateway versus peering versus PrivateLink

Transit Gateway charges for each attachment hour and for data processed. It scales to hundreds of VPCs with central routing and inspection.

VPC peering has no hourly charge and no processing charge. Traffic within the same AZ over a peering connection is not charged, while cross AZ and cross Region traffic is charged at normal transfer rates. For a few high volume VPC pairs, peering is often cheaper than Transit Gateway.

PrivateLink exposes one service, behind a Network Load Balancer, to many consumer VPCs. Consumers pay endpoint hours and processing, and the provider runs the load balancer. It suits a service consumed by many accounts, works with overlapping CIDR ranges and avoids routing whole networks together.

Regional and inter Region patterns

Keep compute next to its data. Reading S3 data from another Region pays inter Region transfer on every read, so copy it once if many jobs read it.

For hybrid traffic, AWS Direct Connect has lower data transfer out rates than the internet, which suits large, steady flows. A Site-to-Site VPN is cheaper to start for small or temporary needs.

How the exam asks about this

• "Private subnets in 40 accounts send terabytes to S3 through NAT gateways, and the bill is high." -> Add S3 gateway endpoints in each VPC.
• "Two VPCs in the same Region exchange very large volumes, and Transit Gateway processing dominates the bill." -> Add a VPC peering connection between those two VPCs.
• "A SaaS provider must offer one API privately to hundreds of customer VPCs with overlapping CIDRs." -> AWS PrivateLink with a Network Load Balancer.