Understanding Network Cost Drivers

Where the network bill comes from

Compute is easy to see on a bill; network costs hide in line items. Without quoting prices, which change, the patterns are stable across providers. Data transfer out to the internet is usually charged per GB, while inbound is typically free. Cross-AZ traffic within a region is often charged in both directions, so a chatty service calling a database in another AZ pays on every request. Cross-region traffic, including inter-region peering, is charged. Managed gateways such as NAT gateways, transit gateways and interface endpoints have an hourly charge plus a per-GB processing charge, so sending terabytes of S3 traffic through a NAT gateway costs far more than a free gateway endpoint. Reduction strategies: keep chatty components in the same AZ where availability allows, use gateway endpoints for S3 and DynamoDB, put a CDN in front of public downloads, compress payloads, and review flow logs to find the top talkers.

Finding the top talkers with Athena

Assumes flow logs are delivered to S3 and a table named vpc_flow_logs has been created over them. It ranks source-destination pairs by bytes.

SELECT srcaddr, dstaddr, SUM(bytes) / 1e9 AS gb
FROM vpc_flow_logs
WHERE action = 'ACCEPT'
GROUP BY srcaddr, dstaddr
ORDER BY gb DESC
LIMIT 10;

One NAT gateway per AZ also saves money

Routing private subnets in AZ b through a NAT gateway in AZ a adds cross-AZ charges on top of NAT processing. A NAT gateway per AZ improves availability and avoids that extra hop.

Quick check: A private service downloads large files from S3 via a NAT gateway. Which change most directly reduces cost?

• Add an S3 gateway VPC endpoint to the private route tables
• Move the instances to a public subnet with no security group
• Enlarge the private subnet's CIDR
• Switch the load balancer from layer 7 to layer 4