Everyone knows cloud egress is expensive. What almost nobody has done is add up the transfer that never reaches the internet at all — the traffic between availability zones, the NAT gateway in the middle, the replica in another region — and discover that it is the same size as the part they were worrying about.
For a fairly ordinary month, the arithmetic below comes out at $3,146, of which $1,783 is the egress everyone talks about and $1,362 is movement inside one AWS account.
Every rate in this post comes from AWS's own price list API rather than from a pricing page, because those pages are JavaScript and cannot be read by anything but a browser. The price list API underneath them is plain JSON with no authentication, and the script that pulls it is in the repository, so the numbers can be refreshed rather than remembered.
Where the money actually is
The shape is consistent across most accounts I have looked at. Internet egress is the largest single line and it is not a majority, because it is the only one anybody designs around. Cross-AZ traffic and NAT gateways are emergent: they are the result of choices about availability and network topology that were made for other reasons, and nobody costed the bytes.
Cross-AZ is charged twice. The price list entry reads "$0.010 per GB - regional data transfer - in/out/between EC2 AZs", and the "in/out" is doing a lot of work: both the sender and the receiver are billed. A service in AZ-a talking to a database in AZ-b pays $0.020 for every gigabyte of conversation. Multi-AZ is not optional for anything serious, but zone-aware routing — keeping a request inside one AZ when a healthy replica is there — usually is, and it is the single largest lever on this line.
The NAT gateway is the one people find last. At $0.045 an hour, three of them cost $98 a month before a single byte moves. Then every gigabyte through them is another $0.045, on top of the internet egress for the same byte. If your private subnets pull container images, call third-party APIs, or ship logs to a SaaS vendor, that traffic is paying both charges.
The usual fix is not a cheaper NAT but fewer bytes through it: gateway VPC endpoints for S3 and DynamoDB carry no per-gigabyte charge at all, which removes image pulls and backup traffic from the NAT entirely.
Region choice is a transfer decision
A team serving Indian users from Mumbai pays 11% more for egress than the same bytes from Virginia — which is usually the right trade, because the latency is worth more than the difference. A team in São Paulo pays 65% more, which is a much harder trade and is rarely revisited once made.
The point is not that you should move regions. It is that the transfer cost of a region is a number you can look up before committing, and almost nobody does.
Work out your own
calculator · data transfer
What moving your data actually costs
the same internet egress, priced in each region
where the transfer bill goes
Every rate here comes from AWS's own price list API rather than from a pricing page, because those pages are JavaScript and cannot be read by anything but a browser: bin/prices/aws-transfer.py pulls them and writes the data file this calculator reads. Published 2026-09-16, fetched 1 Oct 2026. Cross-AZ is charged at the regional rate in each direction, which is why the calculator doubles it. Inter-region uses $0.020/GB, which is what almost every destination out of us-east-1 costs; a few pairs differ. The CloudFront figure assumes every byte is served from the edge with no cache misses, which nothing achieves — treat it as the floor.
Three experiments:
Set cross-AZ to zero. That is what perfect zone-aware routing would buy, and it is the upper bound on what the work is worth. Most teams can get a large fraction of it: read replicas per zone, topology-aware service meshes, and clients that prefer a local endpoint.
Set NAT gateways to 1. Cheaper, and a single point of failure for every private subnet's outbound traffic. This is a real trade rather than a free saving, and it is worth making deliberately rather than by default in a Terraform module somebody copied.
Switch the region to sa-east-1. The same architecture, 65% more for the same bytes. Then switch to CloudFront and watch the comparison change, because a CDN's price does not vary with your origin region.
The CDN arithmetic is not what it looks like
CloudFront from US edges starts at $0.085/GB against the region's $0.090 and falls much further: $0.060 over 50 TB, $0.040 over 150 TB, and $0.020 past 5 PB. It also transfers from origin to edge for free within the same region, so a cache miss does not pay twice.
Which means that for anything cacheable, the CDN is cheaper before you count a single cache hit — and every cache hit after that is pure saving on the origin side. The usual reason teams do not use one for API responses is that they believe the responses are uncacheable, and a surprising share of them are cacheable for five seconds, which is enough to absorb a traffic spike.
| Path | First 10 TB | Over 150 TB | Also charged |
|---|---|---|---|
| EC2 → internet (us-east-1) | $0.090/GB | $0.050/GB | NAT, if via a private subnet |
| CloudFront → internet (US) | $0.085/GB | $0.040/GB | Requests, per 10,000 |
| Cross-AZ, each direction | $0.010/GB | $0.010/GB | Both sides of the conversation |
| us-east-1 → another region | $0.020/GB | $0.020/GB | Plus the destination's own costs |
| Internet → anywhere in | Free | Free | Nothing |
Inbound is free — the architecture guidance states plainly that "there is no charge for inbound data transfer across all services" — which is worth stating because it shapes design in a way people forget: uploading to the cloud costs nothing and downloading costs a lot, and every architecture that moves data out and back pays one way.
The trap in the price list
This is the part that made me stop trusting summaries, including the one above.
AWS's price list for us-east-1 carries DataTransfer-Regional-Bytes at $0.010/GB and USE1-DataTransfer-xAZ-Out-Bytes at $0.00, and their descriptions are the same sentence word for word. The zero-rated one exists because AWS made inter-AZ transfer free for PrivateLink, Transit Gateway and Client VPN in 2022; the charged one still applies to ordinary EC2, RDS and ELB traffic.
So you cannot answer "what does cross-AZ cost me" from a rate card, or from an article. You can only answer it from your own Cost and Usage Report, grouped by usage type, which tells you which line your bytes actually landed on. That is the single most useful hour of work available here and it does not require any architectural change to start.
quick check
Your app in AZ-a writes 10 TB a month to a database in AZ-b. What does the transfer cost, at $0.010 per GB regional?
The price list entry says "in/out/between EC2 AZs" and means it: the sender and the receiver are each charged. Ten terabytes is 10,240 GB, so $102.40 each way, $204.80 in total. This is why zone-aware routing — keeping a request inside one AZ when a healthy replica is there — is the largest single lever on a transfer bill.
What to do, in order of return
- Read the Cost and Usage Report grouped by usage type. An hour of work and it replaces every estimate in this post with your actual numbers, including which cross-AZ rate you are on.
- Add gateway VPC endpoints for S3 and DynamoDB. No per-gigabyte charge, and they remove image pulls and backup traffic from the NAT gateway. Usually the largest saving for the least risk.
- Make routing zone-aware where a local replica exists. Halves or better on the cross-AZ line. Costs real design work and a careful look at what happens when the local replica is unhealthy.
- Put a CDN in front of anything cacheable, including API responses with a five-second TTL. Cheaper per gigabyte before any cache hits, and every hit after that is free.
- Count NAT gateways. One per AZ is the default and often the right answer; three of them idle is $98 a month, and consolidating is a deliberate availability trade.
- Check the region's egress rate before the next deployment decision. It is a published number and it varies by 67%.
What this does not cover
Other providers price this differently and sometimes not at all. Cloudflare R2 charges no egress fee for object storage, and several providers include a transfer allowance with each instance. If your product is bandwidth-heavy — video, large downloads, model weights — that difference can be larger than everything else in your architecture, and it is worth pricing before assuming one cloud.
A CDN does not fix traffic that was never cacheable. If your egress is API responses that genuinely differ per user, a CDN moves the charge rather than removing it, and the request pricing can make small responses worse. The cache hit ratio is the whole variable, and it is worth measuring on a sample before assuming it.
Load balancers add their own charges. ALB and NLB bill in capacity units that include processed bytes, which is a third charge on the same traffic and is not modelled here. For a high-throughput service it is significant.
The free 100 GB and the tier boundaries interact with how you are billed. Tiers apply across the aggregated usage of an account or organisation, not per service, so a second workload can push the first one into a cheaper band — or a consolidated bill can hide which team caused what.
Transfer cost is rarely the reason to change a design. An architecture that halves cross-AZ traffic by removing redundancy is a bad trade at almost any bill size. The interesting savings here are the ones that cost nothing in availability: endpoints, caching, and not paying twice for the same byte. That is the same discipline as any other cloud right-sizing exercise — take the free wins first and stop before you start trading reliability for invoice.
Prices change and this post will age. The script that produced these numbers is in the repository precisely so that the figures can be regenerated rather than trusted. The published date on the price list used here is 16 September 2026.
questions people ask
How much does AWS charge for data transfer out to the internet?
In us-east-1 it is graduated: $0.090 per GB for the first 10 TB a month, $0.085 to 50 TB, $0.070 to 150 TB and $0.050 beyond, with the first 100 GB free. Other regions differ — Mumbai is 11% higher and São Paulo 65% higher for the same volume.
Is cross-AZ data transfer charged in both directions?
For ordinary EC2, RDS and load balancer traffic, yes. The regional rate of $0.010 per GB is billed to both the sender and the receiver, so a round trip costs $0.020 per GB. PrivateLink, Transit Gateway and Client VPN have been free across AZs since 2022, which is why the price list contains two rows with identical descriptions at different prices.
How much does a NAT gateway cost?
In us-east-1, $0.045 per hour per gateway plus $0.045 per gigabyte processed. The per-gigabyte charge is on top of the internet egress for the same byte. Gateway VPC endpoints for S3 and DynamoDB carry no per-gigabyte charge and remove a lot of that traffic.
Is CloudFront cheaper than serving from the region?
At list prices, yes, before any cache hits: $0.085 per GB from US edges against $0.090 from us-east-1, falling much further at volume, with origin-to-edge transfer free in the same region. Requests are charged separately, so very small objects change the comparison.
How do I find out what my data transfer actually costs?
Group your Cost and Usage Report by usage type. That is the only source that tells you which of the several transfer rates your bytes landed on, and it takes about an hour. A rate card cannot tell you, because the same description appears at two different prices.
Can I get data out of AWS for free?
When you are leaving. AWS waives internet egress charges for customers migrating off the platform, following the EU Data Act, and the policy applies globally rather than only in Europe. For ordinary operation, the free allowance is 100 GB a month.
The short version
Internet egress is the transfer cost everyone knows about and it is roughly half the bill. The other half is cross-AZ traffic charged in both directions, NAT gateways charging again for bytes that are already paying egress, and replication between regions.
Three things pay for themselves quickly and cost nothing in reliability: gateway VPC endpoints for S3 and DynamoDB, a CDN in front of anything cacheable, and zone-aware routing where a healthy local replica exists.
Before any of that, group your Cost and Usage Report by usage type. The published rate cards genuinely cannot tell you what you are paying — there are two entries with identical wording and different prices — and an hour with the report replaces every estimate here with your own number.