Skip to content
FR

Design Cost-Optimized Network Architectures

Step 27 of 28

AWS Network Cost Optimization: NAT, Data Transfer and CloudFront

Where this lesson fits

This lesson covers Domain 4: Design Cost-Optimized Architectures, Task 4.4: Design cost-optimized network architectures. Domain 4 represents 20% of the scored content of SAA-C03. AWS network cost optimization requires tracing each traffic path and its billed services: NAT gateway processing fees, cross-AZ traffic, internet egress, and idle load balancers appear as surprising line items. Exam stems describe a topology and a traffic pattern and ask how to reduce charges without breaking security, availability, or performance.

Review VPC topology, connectivity, load balancing and edge performance before comparing charges. This lesson reuses the same services and asks what each one costs and where cheaper equivalents exist.

Learning objectives

After this lesson you will be able to:

  • Explain AWS data transfer pricing: what is free, what is charged, and which direction matters.
  • Reduce NAT gateway cost with VPC gateway and interface endpoints, and by re-architecting traffic flows.
  • Choose between VPC peering, Transit Gateway, PrivateLink, VPN, and Direct Connect on cost and scale.
  • Reduce egress and origin load with Amazon CloudFront and S3 caching strategies.
  • Avoid unnecessary cross-AZ and cross-Region traffic while keeping availability.
  • Choose and consolidate load balancers cost-effectively.
  • Use DNS, IPv6, and Elastic IP practices that avoid hourly charges.
  • Use Cost Explorer, the Cost and Usage Report, VPC Flow Logs, and Network Manager tooling to find network waste.

1. AWS data transfer pricing basics

Data transfer cost follows a few simple rules that the exam relies on.

Traffic path Cost
Internet into AWS (inbound) Free
AWS out to the internet Charged per GB (tiered, cheaper at high volume); an eligible 100 GB monthly allowance applies across services, with Region/offer exclusions
Direct EC2-to-EC2 traffic in the same AZ using private IP addresses No regional transfer charge; intermediate managed services can still charge processing fees
Between AZs in a Region Regional transfer charges commonly apply on both participating EC2 sides; service-specific exceptions apply
Between Regions Charged per GB out of the source Region
Using public or Elastic IP addresses between instances, even in the same AZ Charged like inter-AZ traffic
To S3 or DynamoDB in the same Region via a gateway endpoint Free (no data processing fee)
CloudFront to the internet Compare pay-as-you-go or flat-rate plans, geography, requests and cache hits; origin to CloudFront transfer is free for AWS origins
Direct Connect outbound Pay-as-you-go: port-hour fees plus path-specific transfer rates; eligible dedicated connections also offer flat-rate pricing

The most important consequence: keep chatty components in the same AZ where availability allows, use private IPs, and put caches between users and your origins.

Exam tip. If two EC2 instances in the same AZ talk through their public IPs, you pay for traffic that would be free over private IPs. Replacing public with private addressing is a typical low-effort fix.

2. NAT gateways: the classic hidden cost

A NAT gateway provides outbound translation for private-subnet traffic, including traffic to public AWS service endpoints. The following example uses illustrative US East (Ohio) rates, not a universal AWS price. Its principal charges are:

  1. An hourly charge for each gateway (about $0.045 per hour, around $33 per month), and
  2. A data processing charge per GB (about $0.045 per GB) for all data that passes through, in addition to normal data transfer charges.

For zonal NAT gateways, resilient production designs normally use one per AZ with AZ-local routing. Regional NAT gateways offer another managed multi-AZ model; compare availability, routing and current billing for the selected mode, including hourly charges for each AZ in which the Regional NAT gateway operates. Do not assume every NAT offering is a single-AZ resource.

2.1 Reducing NAT gateway cost

Technique When it applies Effect
Gateway VPC endpoints for S3 and DynamoDB Private subnets that call S3 or DynamoDB Free, remove that traffic from the NAT gateway entirely
Interface VPC endpoints ( PrivateLink) for other AWS services ( ECR, CloudWatch, SQS, Secrets Manager, STS, and so on) Many calls to AWS APIs Hourly cost per endpoint per AZ plus per-GB processing, usually lower than NAT per GB at high volume; also improves security
Place resources in public subnets with a security group Workloads that need only outbound internet and have no strong isolation requirement Avoids NAT only with an internet-gateway route and appropriate public addressing; public IPv4 still bills. Security groups determine inbound access; preserve the workload’s isolation requirements
Egress-only internet gateway for IPv6 IPv6 outbound-only traffic The gateway itself has no hourly charge
Consolidate outbound traffic Many VPCs each with NAT gateways Use a centralized egress VPC through Transit Gateway, trading NAT cost for Transit Gateway processing cost; evaluate per GB
NAT instances Very low traffic dev/test Cheaper at tiny scale, but unmanaged and no built-in resiliency; usually not the exam answer for production
Find the source Unexpected NAT charges Use VPC Flow Logs and CloudWatch NAT metrics to identify which instance is downloading what

2.2 Worked example: NAT gateway bill

Scenario. A data team runs EMR nodes and ETL containers in private subnets across three AZs, with one NAT gateway per AZ. They download and upload about 30 TB per month to Amazon S3, plus 1 TB of package downloads from public repositories. The NAT line item is $1,500 per month.

Step 1: split the traffic. 30 TB goes to S3 (an AWS service in the same Region), and 1 TB goes to the internet.

Step 2: calculate the NAT data processing charge. At about $0.045 per GB, 31 TB (about 31,000 GB) costs about $1,395 per month in processing, plus the three gateways at about $33 each, about $100 per month, totaling around $1,495. This matches the bill.

Step 3: remove the avoidable part. Create an S3 gateway endpoint and add it to the route tables of the private subnets. The 30 TB bypasses the NAT gateways at no charge. The remaining 1 TB (about $45 plus the hourly fees) still uses NAT.

Step 4: result. The NAT line falls from about $1,495 to about $145 per month, a saving of about 90%, without changing application API calls. NAT traffic to AWS public endpoints can already remain on the AWS network; the endpoint changes the route and processing charges, rather than proving prior internet transit. Review VPC security and private connectivity when applying endpoint policies.

Why not more NAT gateways or larger instances? The charge is per GB processed, so adding gateways does not reduce it. Why not an interface endpoint for S3? An S3 interface endpoint has per-GB and hourly charges; the gateway endpoint is free and sufficient for these in-VPC calls. Interface endpoints support access patterns such as on-premises clients that cannot traverse a gateway endpoint; check supported Region/topology options rather than treating an interface endpoint as generic cross-Region access.

3. Connecting VPCs and networks

Option Cost model Best fit
VPC peering No hourly charge; data transfer within a Region is charged only for cross-AZ traffic; cross-Region peering charges per GB A few VPCs needing direct connectivity; non-transitive
Transit Gateway (TGW) Hourly charge per attachment plus per-GB data processing Many VPCs and on-premises networks, transitive routing, central egress or inspection
AWS PrivateLink / interface endpoints Hourly per endpoint per AZ plus per-GB processing Exposing one service to many VPCs or accounts, without full network connectivity
Site-to-Site VPN Hourly connection charge plus data transfer out Quick, encrypted, lower-bandwidth hybrid connectivity; backup for Direct Connect
Direct Connect Pay-as-you-go port-hour plus per-GB charges; eligible 10/100 Gbps dedicated connections can use scoped flat-rate pricing High, steady volume; predictable latency; lower per-GB cost than internet at scale
Direct Connect + VPN Both Encrypted private connectivity
Cloud WAN / Network Manager Managed global network pricing Large global networks (rare at associate level)

Choosing peering versus Transit Gateway. With two or three VPCs, peering is cheaper (no attachment or processing fees). As the number of VPCs grows, the full mesh of peerings becomes unmanageable (n × (n−1) ÷ 2 connections) and Transit Gateway's operational simplicity can justify its charges. Remember that a hub-and-spoke design through TGW has attachment and path-dependent per-GB processing charges; multicast, peering and other traffic paths have specific billing rules, so heavy VPC-to-VPC data flows can make peering cheaper even at scale.

VPN versus Direct Connect. For a branch office sending 50 GB per month, a VPN is cheapest and fast to set up. For a data center moving 100 TB per month, Direct Connect's lower per-GB rate and dedicated bandwidth can win, but the port fee, cross-connect, and months of lead time are significant. Typical stems: "temporary or low-volume, quick" → VPN; "high volume, consistent, long-term, latency-sensitive" → Direct Connect; "need resilience at the lowest cost" → Direct Connect primary with VPN backup.

3.1 Worked example: break-even for Direct Connect

Scenario. A company transfers 60 TB per month from AWS to its data center. Assume an effective internet egress rate of $0.09 per GB, after any tiers or allowances, so 60,000 GB costs $5,400 per month. An illustrative 1 Gbps Direct Connect port is priced at $0.30 per hour (about $219 per month) plus a data transfer rate of about $0.02 per GB.

Step 1: compute Direct Connect. Transfer is 60,000 GB × $0.02 = $1,200. Add the $219 port fee for $1,419, then an assumed $500 carrier/cross-connect fee for $1,919/month, before the backup VPN.

Step 2: compare. $5,400 (internet) versus about $1,919 (Direct Connect), a saving of roughly $3,480 per month.

Step 3: check the capacity. 60 TB per month averages about 185 Mbps (60 × 10¹² × 8 ÷ 2.6 × 10⁶ s ≈ 185 Mbps), well within 1 Gbps.

Step 4: decide. Direct Connect is cheaper under these assumptions. Include VPN hourly charges, traffic shifted during failover and sufficient backup throughput before claiming the final resilient design cost. At 500 GB per month the same comparison reverses, because the fixed fee dominates.

Why not a second internet link? It does not reduce AWS egress charges. Why not Snowball for ongoing transfer? Snow devices are for one-time or periodic bulk moves, not continuous transfer. (Prices are illustrative; exam stems supply their own numbers.)

4. Edge: CloudFront and caching

CloudFront can reduce cost through caching and a suitable pricing model. Compare the complete bill rather than assuming its egress rate is always lower:

  1. Pricing choice. Pay-as-you-go transfer rates vary by edge geography and volume; its eligible free allowance includes 1 TB per month. Current flat-rate plans bundle allowances and features, with plan-specific terms.
  2. Free origin fetch. Transfer from AWS origins (S3, ALB, EC2) to CloudFront is free.
  3. Fewer origin requests. A high cache hit ratio means the origin serves fewer GETs, allowing smaller instances or fewer S3 requests.
  4. Price Classes. Price Class 100 uses only the least expensive edge locations (the United States, Canada, Europe and Israel), Price Class 200 adds more Regions, and All uses every edge location. Selecting a narrower price class lowers cost if most users are in those areas, at the price of potentially higher latency elsewhere.

Other practices: set long TTLs and use cache keys that exclude unneeded headers, cookies, and query strings to raise the hit ratio; enable compression; use Origin Shield only when it reduces origin load enough to justify its fee; use CloudFront Functions for lightweight edge logic (cheaper than Lambda@Edge); compare eligible CloudFront Security Savings Bundle commitments with pay-as-you-go and flat-rate plans. Flat-rate plans cannot be combined with other offers or discounts; do not stack hypothetical savings.

S3 Transfer Acceleration and Global Accelerator improve performance, but they add per-GB fees. Choose them only when the performance requirement justifies it.

4.1 Worked example: egress through CloudFront

Scenario. An educational site serves 40 TB per month of video files from S3 directly to learners worldwide, paying roughly $0.09 per GB of internet egress, or about $3,600 per month. Most of the library is requested repeatedly. Learners are mostly in North America and Europe.

Step 1: put CloudFront in front of the bucket using Origin Access Control, a bucket policy granting the intended distribution access, and S3 Block Public Access. Use the S3 REST origin, not its website endpoint; OAC alone does not remove other authorized access paths.

Step 2: estimate the new cost. S3-to-CloudFront transfer is free. CloudFront egress for the first TB per month is free, and apply the chosen edge-geography rate tiers to the remaining volume and add request/feature charges. As a simplified illustration, 39,000 GB at a flat $0.085/GB would be $3,315 before requests and other fees; actual tiers and allowances can change this. A high cache-hit ratio reduces origin requests. Compare any eligible commitment with a separate flat-rate-plan estimate.

Step 3: tune. Choose Price Class 100 because users are in North America and Europe, enable compression for text assets, and use a long TTL for versioned video files.

Step 4: decide. CloudFront with Origin Access Control and Price Class 100.

Why not Transfer Acceleration? It supports both uploads and downloads through accelerated S3 endpoints, but does not provide CloudFront's reusable edge cache. For repeated cacheable lecture downloads, compare cache hit ratio, origin requests and current CloudFront versus S3 acceleration/egress fees. Why not replicate the bucket to more Regions? Replication adds storage and transfer costs and does not itself cache content near every viewer.

5. Cross-AZ and cross-Region traffic

Cross-AZ traffic is usually the cost of resilience, so the goal is to avoid unnecessary crossings rather than to collapse into one AZ.

  • Keep tiers zone-aware. Chatty microservices that always call a random instance in another AZ create a cross-AZ bill. Zone-aware routing (such as topology-aware routing in Kubernetes, or an ALB target group with cross-zone load balancing disabled where supported and safe) reduces it. Note that ALB cross-zone load balancing is on by default and its inter-AZ transfer is not charged to you, while NLB and Gateway Load Balancer cross-zone traffic is charged.
  • RDS Multi-AZ replication traffic is not charged to you, but application connections to a reader or read replica in another AZ can incur transfer charges. A classic Multi-AZ DB instance’s single standby cannot serve reads; Multi-AZ DB clusters have readable instances.
  • Place read replicas near consumers to reduce chatty cross-AZ or cross-Region reads.
  • Replicate cross-Region only to meet requirements. S3 CRR adds replication transfer/storage costs. DynamoDB global tables bill replicated writes and replica storage, but do not charge inter-Region data transfer for that replication; do not reuse S3's cost model for DynamoDB.
  • Compress data before moving it between Regions or to on premises.

6. Load balancers and addresses

Resource Cost trap Fix
Application Load Balancer Hourly charge plus load balancer capacity units (LCU) Consolidate multiple apps behind one ALB using host-based and path-based rules; delete unused ALBs
Network Load Balancer Hourly plus NLCU, cross-zone traffic charged Use only when TCP/UDP, static IPs, or extreme performance are needed
Gateway Load Balancer Appliance insertion fees Only for third-party virtual appliances
Public IPv4 addresses AWS charges about $0.005 per hour for every public IPv4 address (in use or idle) Remove unneeded public IPs, use IPv6 or private connectivity, release unattached Elastic IPs, front fleets with a load balancer or use Systems Manager Session Manager rather than public SSH
Route 53 Hosted zone fee plus per-query fee Alias queries to supported AWS targets are free of query charge. AWS-target aliases inherit the target TTL; choose longer TTLs only where configurable and compatible with failover
Elastic IP Charged when idle or associated with a stopped instance and, since 2024, all public IPv4 addresses Release unused ones

Exam tip. Since February 2024, every public IPv4 address (including Elastic IPs and those attached to running instances) is charged hourly. IPv6 addresses have no public-IPv4 hourly charge, but routes, processing services and data transfer can still bill. IPv6 and private subnets with endpoints can reduce address cost when the stem hints at "reduce public IP charges".

7. Finding network waste

Tool What it shows
Cost Explorer Group by usage type (for example NatGateway-Bytes, DataTransfer-Regional-Bytes, DataTransfer-Out-Bytes) to see which transfer type is expensive
Data Exports CUR 2.0 + Athena Detailed transfer usage and available resource identifiers; not every line item includes a resource ID
VPC Flow Logs Which sources and destinations send the most bytes through NAT or across AZs
CloudWatch metrics NAT BytesOutToDestination, load balancer ProcessedBytes and LCU, ActiveFlowCount
Trusted Advisor Idle load balancers, unassociated Elastic IPs
AWS Budgets and Cost Anomaly Detection Alerts when transfer spend spikes

8. Common pitfalls and exam tips

  • Gateway endpoints for S3 and DynamoDB are free; interface endpoints are not. When the stem says traffic goes to S3 from private subnets through a NAT gateway, the gateway endpoint is the cost answer.
  • Additional zonal NAT gateways add hourly cost, but AZ-local egress preserves resilience. Compare a regional NAT configuration when available; evaluate availability and processing/transfer charges rather than simply removing redundancy.
  • Transit Gateway is not free. It has per-attachment and per-GB charges; peering is cheaper for a few VPCs.
  • Inbound data is free; outbound is not. Moving compute to the data (analyze in AWS) can avoid egress.
  • Direct Connect lowers per-GB cost but adds fixed cost and lead time. It is not an answer for quick or low-volume needs.
  • CloudFront is both a performance and a cost tool, especially with AWS origins where origin-to-edge transfer is free.
  • Public IPv4 charges apply to idle and in-use addresses.
  • Idle load balancers and unattached Elastic IPs still bill.
  • Exam tip: In the answer choices, prefer the managed, configuration-only change (add a gateway endpoint, adjust a price class, consolidate ALBs) over rewriting applications or building custom proxies.

9. Mini case study (with solution)

Scenario. LearnLoop is an online course platform with two production VPCs (web and data) and a development VPC, each in three AZs with one NAT gateway per AZ. Findings from Cost Explorer: NAT gateway data processing is $2,400 per month, mostly traffic from ECS tasks to S3 and DynamoDB; cross-AZ transfer is $900 per month because ECS services call a backend through its public Elastic IP; the platform serves 25 TB of lecture video per month straight from S3 to learners mostly in the US and Canada; 14 Application Load Balancers exist, six of them with no targets; the company sends 40 TB per month to an on-premises analytics cluster over the internet and pays for egress. A site-to-site VPN connects the office, and the CFO wants cost reduced by at least 30% without lowering availability.

Solution.

  1. NAT: add S3 and DynamoDB gateway endpoints to the private route tables. This removes the dominant NAT processing traffic at no charge. Keep one NAT gateway per AZ in production; in the development VPC, use fewer gateways only if development availability permits it. NAT gateways have no stop/start schedule; deletion and recreation would require separate automation and route updates.
  2. Cross-AZ via public IP: use private addressing/internal DNS to remove unnecessary public-address dependencies and costs. This alone does not eliminate regional cross-AZ data-transfer charges. Prefer AZ-local calls where safe, retain cross-AZ failover paths, and compare traffic volume by actual route/AZ before estimating savings.
  3. Video: put CloudFront in front of S3 with Origin Access Control, long TTLs, and Price Class 100 (North America and Europe).
  4. Load balancers: delete the six unused ALBs and consolidate the remaining apps using host-based routing where security boundaries allow.
  5. Analytics transfer: at 40 TB per month a Direct Connect link (with the existing VPN as backup) probably costs less per GB than internet egress; compute the break-even and confirm the lead time is acceptable. Alternatively, run the analytics in AWS (Athena, EMR) to avoid egress.
  6. Governance: track DataTransfer and NatGateway-Bytes usage types in Cost Explorer, set Budgets alerts, and use Flow Logs to confirm.

Why not delete two of the three production NAT gateways? It would cut hourly fees but violate the availability requirement, and endpoints already remove most traffic. Why compare peering with Transit Gateway for three VPCs? Peering has no attachment or processing fee, while regional cross-AZ/cross-Region transfer may still bill. TGW adds attachment and applicable processing charges but may be justified by transitive routing or central inspection.

10. Key terms

  • Gateway endpoint: free VPC endpoint for S3 and DynamoDB using route table entries.
  • Interface endpoint (PrivateLink): ENI-based private access to AWS services or partner services, billed hourly and per GB.
  • NAT gateway: managed NAT with hourly and per-GB processing charges.
  • Transit Gateway: regional network hub billed per attachment and per GB.
  • Direct Connect: dedicated private network connection with port-hour fees.
  • Egress: data leaving AWS to the internet or another Region.
  • Price Class: CloudFront setting that limits the edge locations used and the price.
  • Cross-AZ traffic: data between AZs, charged per GB each way.
  • Public IPv4 charge: hourly fee for each public IPv4 address.
  • LCU: load balancer capacity unit, the usage measure for ALB billing.

11. Summary checklist

  • I can state which data transfer paths are free and which are charged.
  • I can reduce NAT gateway cost with gateway endpoints, interface endpoints, and traffic re-routing.
  • I can compare VPC peering, Transit Gateway, PrivateLink, VPN, and Direct Connect on cost and scale.
  • I can do a simple Direct Connect versus internet egress break-even calculation.
  • I can use CloudFront, Price Classes, and caching to reduce egress and origin cost.
  • I can avoid unnecessary cross-AZ, cross-Region, and public-IP traffic.
  • I can consolidate and clean up load balancers and public IPv4 addresses.
  • I can use Cost Explorer usage types, Flow Logs, and CloudWatch to find network waste.

Include archive retrieval and request charges when moving stored data: see S3 lifecycle and storage cost optimization.

Sources