# Understanding Network Cost Drivers — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-network-cost

> Recognise which traffic patterns generate data-transfer and processing charges and design to reduce them.

## Where the network bill comes from

Compute is easy to see on a bill; network costs hide in line items. Without quoting prices, which change, the patterns are stable across providers. **Data transfer out to the internet** is usually charged per GB, while inbound is typically free. **Cross-AZ traffic** within a region is often charged in both directions, so a chatty service calling a database in another AZ pays on every request. **Cross-region traffic**, including inter-region peering, is charged. **Managed gateways** such as NAT gateways, transit gateways and interface endpoints have an hourly charge plus a per-GB processing charge, so sending terabytes of S3 traffic through a NAT gateway costs far more than a free gateway endpoint. Reduction strategies: keep chatty components in the same AZ where availability allows, use gateway endpoints for S3 and DynamoDB, put a CDN in front of public downloads, compress payloads, and review flow logs to find the top talkers.

## Finding the top talkers with Athena

Assumes flow logs are delivered to S3 and a table named `vpc_flow_logs` has been created over them. It ranks source-destination pairs by bytes.

```sql
SELECT srcaddr, dstaddr, SUM(bytes) / 1e9 AS gb
FROM vpc_flow_logs
WHERE action = 'ACCEPT'
GROUP BY srcaddr, dstaddr
ORDER BY gb DESC
LIMIT 10;
```

## One NAT gateway per AZ also saves money

Routing private subnets in AZ b through a NAT gateway in AZ a adds cross-AZ charges on top of NAT processing. A NAT gateway per AZ improves availability and avoids that extra hop.

**Quiz:** A private service downloads large files from S3 via a NAT gateway. Which change most directly reduces cost?

- [x] Add an S3 gateway VPC endpoint to the private route tables
- [ ] Move the instances to a public subnet with no security group
- [ ] Enlarge the private subnet's CIDR
- [ ] Switch the load balancer from layer 7 to layer 4

*Answer:* Add an S3 gateway VPC endpoint to the private route tables. The gateway endpoint routes S3 traffic privately with no NAT processing charge and no hourly endpoint fee.