AWS charges for data on the move in four main ways: data leaving to the internet, traffic crossing between Availability Zones, traffic crossing between regions, and bytes processed through NAT gateways and similar network services. Inbound data from the internet is generally free, and traffic that stays inside one Availability Zone over private addresses is usually free, which means your architecture, not your usage growth, decides most of the bill. The charges that surprise teams are not the obvious internet egress but the internal ones: a chatty service spread across Availability Zones, or a private subnet routing all of its S3 and public traffic through a metered NAT gateway. The fix is rarely to send less data and almost always to change the path the data takes.
Here is each charge, why it grows quietly, and the moves that cut it.
What does AWS actually charge for?
Four buckets cover the vast majority of transfer cost. Internet egress is data sent from AWS out to the public internet, priced per gigabyte on a tiered scale that falls as volume rises. Cross Availability Zone transfer is billed when resources in different zones talk to each other, charged on both ends in many cases. Cross region transfer applies when data moves between regions, at a higher rate than cross zone. NAT gateway processing adds a per gigabyte fee on every byte that flows through the gateway, on top of its hourly charge. Layer in CloudFront, VPC peering, and Transit Gateway, each with their own transfer rates, and you have a map of where the money goes. The unifying point: traffic that stays local and private is cheap, and traffic that crosses a boundary or a metered device is not.
Why is cross Availability Zone traffic a quiet budget eater?
Teams spread workloads across Availability Zones for resilience, which is correct, then forget that the resilience has a data transfer price. A microservice mesh, a database replica, or a cache that sits in a different zone from its callers generates cross zone transfer on every request, billed per gigabyte and often on both sides. At low traffic it is noise. At scale it becomes a recurring charge that tracks request volume. The lever is topology aware routing: keep high volume chatter within a zone where availability targets allow, and reserve cross zone hops for the traffic that genuinely needs the redundancy. You keep the resilience where it matters and stop paying for it where it does not.
How much does the NAT gateway really cost?
The NAT gateway is the classic surprise. It bills an hourly rate for being there plus a per gigabyte processing charge for everything that passes through it. When private subnets route their outbound traffic, including calls to S3, DynamoDB, and other AWS services, through a NAT gateway, every one of those gigabytes carries the processing fee. The remedy is gateway and interface VPC endpoints, which let private subnets reach supported AWS services without traversing the NAT gateway at all, removing the processing charge on that traffic. For an estate moving large volumes to S3 from private subnets, switching that path to a gateway endpoint is one of the cleanest data transfer wins available.
A Fortune 500 retailer ran data heavy batch jobs in private subnets that pulled and pushed large volumes to S3, with all of that traffic routed through NAT gateways. The Cost and Usage Report showed NAT gateway processing as one of the largest network lines on the bill, driven almost entirely by S3 traffic that did not need to leave AWS. Adding S3 gateway endpoints moved that traffic off the NAT gateways and eliminated the processing fee on it, while a review of cross zone replica placement trimmed the remaining transfer. The combined change cut the estate's data transfer spend by close to a third with no application changes. The figures are verified against billing data and anonymised.
How do you find transfer costs in the bill?
Start with the Cost and Usage Report, the source of truth for AWS billing. Filter for usage types whose names contain DataTransfer, then add the NAT gateway processing usage type and the per service transfer lines such as those from S3 and CloudFront. Group the result by service and by Availability Zone to see where bytes actually move, because the aggregate number tells you the size of the problem but not its location. Cost Explorer gives a faster, coarser read for a first pass. The goal is to attribute every transfer dollar to a path, because once you can see the path you can decide whether to keep it private, add an endpoint, collapse a cross zone hop, or front it with CloudFront.
The moves that cut data transfer cost
Five levers cover most estates. Add VPC endpoints so private traffic to AWS services skips the NAT gateway. Keep high volume service to service traffic within an Availability Zone where your resilience targets allow it. Front heavy internet egress with CloudFront, whose egress rates and caching can beat raw transfer for cacheable content. Co locate compute with the data it reads so you avoid cross region pulls. And review replica and backup placement, since cross region copies are a deliberate cost that should match a real recovery requirement. None of these reduce what your product does; they reduce the distance and the metering the bytes pass through.
Frequently asked questions
What types of data transfer does AWS charge for?
Why is the NAT gateway often a surprise cost?
How do you find data transfer costs in the bill?
Cut your AWS data transfer bill with us
We map every transfer dollar on your AWS estate to a path and remove the ones you should not be paying, from NAT gateway processing to needless cross zone chatter. We take zero provider commissions and answer only to you. Our guarantee: we reduce your cloud spend or we reimburse our service fee, on either a Fixed Fee or a no risk Gainshare basis. Book a strategy call to scope it, and follow more in The Cloud Spend Navigator.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.