Network architecture choices that cut the AWS bill

Why network spend hides on AWS

Network charges rarely show up as a single line. They accrue as data processing on NAT gateways, transfer between Availability Zones and Regions, and egress to the internet, all metered per GB. A service can look cheap on compute and still run a five figure monthly network bill underneath.

Because these meters are usage based, you cannot commit your way out of them. The fix is to move traffic off the billed path or onto a cheaper one.

NAT gateways: the quiet budget eater

A NAT gateway charges an hourly rate plus a per GB data processing charge on everything that flows through it. For workloads that pull large volumes from AWS services in the same Region, routing that traffic through a NAT gateway pays the processing fee for no reason.

The fix is a VPC gateway endpoint for Amazon S3 and DynamoDB, which is free, and interface endpoints for other services where the endpoint hourly plus per GB rate beats the NAT processing rate at your volume. High volume private subnets often cut NAT spend sharply once S3 and DynamoDB traffic leaves the NAT path.

Inter AZ traffic and egress

Traffic between Availability Zones is billed per GB in each direction. Chatty services spread across three zones for resilience can pay a surprising amount simply talking to themselves. Keeping tightly coupled components zone aware, and routing through zonal endpoints where it makes sense, trims this without weakening resilience.

For internet egress, putting CloudFront in front of heavy outbound traffic moves bytes onto cheaper distribution rates and cuts origin egress, while cross Region replication should be scoped to data that genuinely needs a second Region rather than copied wholesale.

A worked comparison

Indicative figures, verified against the client's billing data, anonymized. A European SaaS company moved high volume S3 and DynamoDB traffic off its NAT gateways and fronted its public API with CloudFront.

Your next step

Start by attributing network spend to NAT, inter AZ, and egress, then attack the largest meter first. For the full method read the AWS cost optimization guide, and for neighbouring detail see NAT gateway costs and the alternatives and data transfer between AZs and Regions. To apply it, our AWS cost optimization service turns the map into verified savings, and you can request a free trial.