AWS costs: Data transfer pricing - the map of what is free and what is not

Data moving into AWS from the internet is free, full stop, on almost every service. Data moving out to the internet is what gets billed, and the first 100 GB a month is free too, aggregated across your whole account. The part almost nobody expects: moving data between two Availability Zones in the very same AWS region — two servers a few miles apart, never touching the public internet — is not free. AWS bills it going out of the first AZ and again coming into the second, so a "local" transfer quietly turns into two separate line items on your bill.

The four boundaries that decide whether you pay

Jake runs a small phone shop, and he does his own bookkeeping. He called Ethan after his AWS bill jumped $340 in a month with, in his words, "no new customers, no new features, nothing." Ethan's first question wasn't "what did you build." It was "where does your data cross a line."

According to AWS's own network FAQ, there are three broad categories of charge: data transfer out to the internet (DTO), data transfer between Availability Zones in the same region (DTAZ), and data transfer between regions (DTIR). A fourth category sits alongside them — the specialized services, like CloudFront and Direct Connect, that have their own separate rate cards instead of using the standard DTO rate. For DTO and DTIR, AWS bills based on the source Region only, not the destination, so where your data lands doesn't change the price — where it starts does.

You can Also Read: AWS costs: The NAT gateway bill - the $32/month nobody planned

Data transfer into AWS is the one boundary that has no exceptions worth documenting: when your resources on the public internet send data into resources residing within AWS, there is no charge. Uploading a 4K video to S3, restoring a database from an on-premises backup, streaming logs from a data center into CloudWatch — all free, every time, on every service AWS's FAQ covers.

The 100 GB free tier: what it covers and what it doesn't

AWS Free Tier gives every account 100 GB of data transfer out to the internet, free, every month, aggregated across all AWS services and Regions except China and GovCloud. That 100 GB is a single global pool — it does not apply separately per Region, so running workloads in three Regions doesn't get you 300 GB free. On top of that, AWS separately gives 1 TB of free data transfer out of Amazon CloudFront every month.

The free tier does not renew unused capacity — it resets to zero each billing cycle and unused GB never rolls over. Rate tiers for paid DTO take aggregate usage across a long list of services into account, including EC2, S3, Glacier, RDS, Redshift, SageMaker, SES, SimpleDB, SQS, SNS, DynamoDB, Storage Gateway, CloudShell, CloudWatch Logs, MediaConnect, and Elastic Load Balancing, per AWS's global network FAQ — so a small S3 download and a small EC2 response draw from the exact same 100 GB bucket, not separate ones.

Data transfer out to the internet (DTO): the one everyone budgets for

DTO is data transfer from a service inside an AWS Region, Local Zone, or Wavelength Zone out to the public internet. It's tiered by monthly volume — the more you send, the lower the per-GB rate gets in the higher bands — and it varies by source Region. AWS's own pricing examples for the Regional NAT Gateway walk through a case using $0.09 per GB as the Data Transfer Out to Internet rate for a US region, applied after the free tier is exhausted. Past 500 TB a month, AWS asks you to contact its sales team directly rather than relying on the published tiers.

Traffic direction	Charged?	Documented by AWS as
Internet → AWS (uploads, inbound API calls)	No, always free	"Data ingress" – no charge on any listed service
AWS → internet, first 100 GB/month	No, Free Tier	AWS Free Tier, aggregated globally
AWS → internet, past 100 GB/month	Yes	Data Transfer Out (DTO), tiered per-GB, by source Region
AWS service → Amazon CloudFront	No	"We do not charge for data transfer from AWS services to Amazon CloudFront"

Ethan's take: "People treat the 100 GB free tier like it's generous. For a static site or a small API it is. For anything serving images, video, or downloads to real users, you'll blow through it in the first week of the month and never notice until the bill lands."

Between Availability Zones (DTAZ): the fee that hits well-architected apps hardest

An Availability Zone (AZ) is one of the multiple, physically separate data center clusters that make up a single AWS Region. Best-practice architecture spreads your instances across two or three AZs on purpose, so one data center failure doesn't take your whole app down. That's the correct call for reliability. It is also the exact pattern that generates the charge nobody warns you about.

Per AWS's global network FAQ, there is a charge for data transferred "in" and "out" from Amazon EC2, Amazon RDS, Amazon Redshift, DynamoDB Accelerator (DAX), Amazon ElastiCache instances, and Elastic Network Interfaces across Availability Zones in the same Region. The same applies to traffic between a Local Zone and an AZ in the same Region, and to EC2 traffic in a Local Zone. For VPC Peering connections specifically, AWS's VPC pricing page states the rate in plain terms: data sent over VPC peering that crosses an AZ within the same Region is charged at $0.01 per GB in both the "In" and "Out" direction — the same $0.01/GB-each-way structure applies to ODB (Outposts) peering traffic crossing AZs.

There is real relief documented alongside this, though. It is free to transfer data directly between Amazon S3, EBS direct APIs, Glacier, DynamoDB, SES, SQS, Kinesis, ECR, SNS, or SimpleDB and EC2 instances in the same Region — AZ boundaries inside that same-Region path don't trigger a charge on their own. The catch: if another AWS service sits in the path, such as a PrivateLink endpoint, a NAT Gateway, or a Transit Gateway, you pay that service's own data-processing cost instead. It is also free to send data in and out of Classic and Application Load Balancers using private IP addresses, and between EC2 instances and the load balancer inside the same VPC.

Ethan's take: "This is the one I actually get annoyed about on Jake's behalf. You did the responsible thing — you spread instances across zones for redundancy — and AWS bills you for the privilege of following its own best-practice guide. It's not a scam, it's a real network cost being passed through. But budget for it before you build the architecture, not after the bill arrives."

Between Regions (DTIR): replication, disaster recovery, and multi-region apps

DTIR is data transfer from a service in one AWS Region, Local Zone, or Wavelength Zone to another. Like DTO, AWS bills DTIR based on the source Region only. This is the charge behind cross-Region S3 replication for compliance or disaster recovery, a database sending read replicas to another Region, or a multi-Region deployment keeping two stacks in sync.

Two specific carve-outs are worth knowing if your workload touches them. First, AWS offers eligible customers free DTIR when migrating data from the Singapore Region to the new Malaysia or Thailand Regions, through a pre-approval process with AWS Customer Support — you request it before you move, not after. Second, and more broadly useful: EU customers may request reduced data transfer rates for eligible use cases under the EU Data Act, again by contacting AWS Customer Support rather than seeing it applied automatically.

NAT Gateway: the tax on outbound traffic from private subnets

If your EC2 instances sit in a private subnet with no direct internet-facing IP, a NAT Gateway is how they reach the internet or other AWS services outside the VPC. AWS documents the charge in two parts: an hourly charge for every hour the NAT Gateway is provisioned, and a per-GB data processing charge for every gigabyte that passes through it — regardless of where that traffic came from or where it's going. Standard AWS data transfer charges apply on top of that for the destination the traffic is actually headed to.

AWS's own worked example makes the layering clear. An EC2 instance behind a NAT Gateway in US East (Ohio) sends 1 GB to an S3 bucket in the same Region and same AZ. The NAT Gateway's hourly rate in that example is $0.045/hour, and the 1 GB processed through it costs $0.045 in data processing. But the data transfer charge itself is $0 — because the EC2-to-S3 path in the same Region is free, and the EC2-to-NAT-Gateway hop stays in the same AZ on a private IP. Send that same 1 GB to a destination on the public internet instead, and AWS's Regional NAT Gateway example shows the DTO charge landing on top at $0.09/GB.

1. Identify what's actually routing through the NAT Gateway. Check your VPC route tables for private subnets pointing a 0.0.0.0/0 route at the NAT Gateway.
2. Separate AWS-service traffic from true internet traffic. Calls to S3 or DynamoDB don't need to leave the VPC at all if you route them differently (see the next section).
3. Add a Gateway VPC endpoint for S3 and DynamoDB traffic specifically. AWS documents these as having no data processing or hourly charges.
4. Leave genuine internet-bound traffic on the NAT Gateway. There's no way around the NAT Gateway for actual public-internet destinations; you're only removing the traffic that never needed to be there.

AWS also documents a Regional NAT Gateway option that spans multiple AZs under one logical gateway. It's billed per AZ it's active in — three AZs means three NAT-Gateway-hours each hour — and billing adjusts automatically the moment an AZ is removed from the configuration.

VPC endpoints and PrivateLink: the free and discounted lanes

There are two shapes of VPC endpoint, and AWS prices them completely differently. Gateway endpoints exist only for S3 and DynamoDB, and per AWS's VPC pricing page, there are no data processing or hourly charges for using them at all — they're a route-table entry, not a piece of billed infrastructure.

Interface endpoints, which cover most other AWS services and third-party or partner services running on AWS, are billed differently: an hourly charge for every hour the endpoint is provisioned in each Availability Zone, plus a per-GB data processing charge. AWS's PrivateLink pricing page lists that data processing charge as tiered by total monthly volume across all interface endpoints in a Region: $0.01/GB for the first 1 petabyte, $0.006/GB for the next 4 PB, and $0.004/GB for anything past 5 PB. Some AWS services fold the interface endpoint cost into their own service pricing instead of billing it separately — check that specific service's pricing page if the endpoint charge doesn't show up where you expect it.

Endpoint type	Hourly charge?	Data processing charge?
Gateway endpoint (S3, DynamoDB only)	No	No
Interface endpoint (PrivateLink)	Yes, per AZ provisioned	Yes, tiered $0.01 → $0.004/GB

CloudFront: turning egress into one flat, usually cheaper number

Amazon CloudFront is AWS's content delivery network, and its free tier is separate from — and larger than — the general DTO free tier. AWS's CloudFront documentation lists the always-free allowance as 1 TB of data transfer out to the internet per month, 10,000,000 HTTP or HTTPS requests per month, 2,000,000 CloudFront Function invocations per month, and 2,000,000 CloudFront KeyValueStore reads per month, with free SSL certificates and no feature restrictions attached to the free tier.

The part that surprises people moving from direct S3 or EC2 delivery: any cacheable data transferred to CloudFront edge locations from your AWS origins incurs no additional charge, and AWS's global network FAQ separately confirms that data transfer from AWS services to CloudFront specifically is free. CloudFront then charges for what actually leaves its edge locations toward end users, plus HTTP/HTTPS request volume, priced by usage type, geography, and the features you've selected — those per-GB tiers beyond the free 1 TB vary by edge location and should be checked on the live CloudFront pricing page rather than assumed, since they move over time.

AWS's own explanation of how DTO differs from CloudFront and Global Accelerator is useful for deciding which one fits: standard DTO sends traffic directly out to the public internet over the AWS backbone and third-party carrier networks, optimizing for network performance without caching. CloudFront improves performance for both cacheable content, like images and video, and dynamic content, like API responses and full site delivery, using edge locations. Global Accelerator instead proxies TCP or UDP packets at the edge toward applications running in one or more Regions — it's a performance tool, not primarily a cost-reduction one, and it carries its own separate pricing.

Direct Connect: the private line for heavy, steady movers

AWS Direct Connect is a dedicated network connection between your own data center and AWS, bypassing the public internet entirely. AWS's pricing page for it states plainly that data transfer in over Direct Connect is $0.00 per gigabyte at all Direct Connect locations — ingress is free here too, same as everywhere else on this map. Data transfer out is where the charge sits, and AWS's own pricing documentation notes that DTO pricing depends on both the source AWS Region or Local Zone and the specific Direct Connect location you're using, with a lookup table by geographic bucket rather than one flat number.

On top of DTO, you pay for port hours — the time a physical or logical port is reserved for you, billed whether or not data is actually flowing. AWS's dedicated-connection port pricing scales with bandwidth, from roughly $0.076/hour at the low end up toward $2.48/hour for a 25 Gbps dedicated port, according to AWS's published rate table; hosted connections, provisioned through an AWS Direct Connect Delivery Partner rather than directly from AWS, offer smaller bandwidth increments at correspondingly smaller hourly rates. AWS's documentation is explicit on one important point: Direct Connect only sends data to your Direct Connect location, not out to the internet directly — for internet-bound egress you're still looking at standard DTO rates once the traffic leaves that location.

Leaving AWS entirely: the free-egress program almost nobody asks about

AWS documents a specific, pre-approval process for waiving DTO charges when you're moving all of your data off AWS — to another cloud provider or back on-premises. It is not automatic, and AWS is explicit about why: customers make hundreds of millions of data transfers a day, and AWS generally has no way to tell a routine transfer to an end user apart from a one-time move off the platform. You have to tell them first.

1. Talk to your account team first, if you have one. If you have a negotiated commitment with AWS, your options may differ from the standard process.
2. Contact AWS Customer Support and say you're requesting "free data transfer to move off AWS." They'll ask for details on your migration plan to evaluate eligibility and calculate a credit.
3. If approved, you get a temporary credit and 60 days to complete the move. The credit only offsets DTO usage, not other service charges, and you must delete remaining data or close your account within that window.

The fine print matters. If you have less than 100 GB stored, you're expected to move it under the existing Free Tier allowance rather than requesting additional credit. Only data transfer out in direct support of the move qualifies — DTO from CloudFront, Direct Connect, Snow Family devices, and Global Accelerator is explicitly excluded from these credits. And AWS reserves the right to review usage afterward; if the data transfer out turns out to have served a different purpose, they can bill it retroactively.

Finding data transfer charges on your actual bill

AWS's own FAQ points to two places: the Billing & Cost Management Dashboard for a top-line view, and Cost Explorer for a more granular, line-item breakdown of data transfer specifically. You can also build a forward-looking estimate rather than waiting for a bill to arrive — the AWS Pricing Calculator has a dedicated data transfer service you can search for and configure by Region and monthly volume for different transfer flows, which is the more honest way to sanity-check an architecture before you commit to it. One more detail worth knowing: unless otherwise stated, AWS's published data transfer prices are exclusive of applicable taxes and duties, including VAT and sales tax, and customers with a Japanese billing address are separately subject to Japanese Consumption Tax.

The free-vs-billed map, in one table

Pulling every boundary above into one reference. This is the table worth bookmarking.

Path	Status
Internet → any AWS service	Free, always
AWS → internet, up to 100 GB/month total	Free (Free Tier, global pool)
AWS → internet, beyond 100 GB/month	Billed, tiered, by source Region
AWS service → CloudFront (same account)	Free, always
CloudFront → internet, up to 1 TB/month	Free (CloudFront Free Tier)
S3/DynamoDB/SQS/SNS/Kinesis/ECR/SES/SimpleDB ↔ EC2, same Region	Free, direct path only
EC2/RDS/Redshift/DAX/ElastiCache/ENI across AZs, same Region	Billed (DTAZ), in and out
VPC Peering / ODB Peering across AZs, same Region	Billed, $0.01/GB each direction
Any service → another Region	Billed (DTIR), by source Region
Through a Gateway VPC endpoint (S3, DynamoDB)	Free, no hourly or per-GB fee
Through an Interface (PrivateLink) endpoint	Billed hourly plus tiered per-GB
Through a NAT Gateway	Billed hourly plus per-GB processing, plus destination's own DTO/DTAZ/DTIR
Through Direct Connect, inbound	Free, $0.00/GB
Through Direct Connect, outbound	Billed by source Region and DX location, plus port-hours
Load balancer ↔ EC2, same VPC, private IP	Free

The architecture mistakes that quietly rack up the bill

Three patterns account for most of the surprise charges Jake-style small operators run into, and none of them are exotic:

Instances scattered across AZs without a reason. Multi-AZ is correct for production reliability. It's often accidental for dev and test environments, where someone launched resources in whatever AZ the console defaulted to that day, with no failover requirement to justify the DTAZ cost being generated between them.

Routing AWS-to-AWS traffic through a NAT Gateway that a Gateway endpoint could handle for free. This is specific to S3 and DynamoDB, but those two services carry an enormous share of typical application traffic, and AWS explicitly documents the Gateway endpoint route as carrying no data processing or hourly charge at all.

Serving files directly from S3 or EC2 to end users instead of through CloudFront. The free tier gap alone — 100 GB versus 1 TB — makes this an easy first fix for anything public-facing and cacheable.

Researcher, academic, and EU discounts

AWS documents a data egress discount specifically for qualified researchers and academic customers, waiving a portion of data transfer out charges. The maximum discount AWS lists is 15% of total monthly AWS spend, which AWS describes as several times the typical usage seen among its research customers — eligibility is checked through AWS's public-sector program, not applied automatically. Separately, EU customers may request reduced data transfer rates for eligible use cases under the EU Data Act by contacting AWS Customer Support directly; AWS does not publish a standard reduced rate card for this, since it's evaluated case by case.

Frequently asked questions

Is uploading data to AWS ever billed?

No. AWS's global network FAQ states plainly that when resources on the public internet send data into AWS, there is no charge, and this applies across virtually every listed service, not just a handful of them.

What exactly counts against the 100 GB free tier?

Aggregate Data Transfer Out to the internet across EC2, S3, Glacier, RDS, Redshift, SageMaker, SES, SimpleDB, SQS, SNS, DynamoDB, Storage Gateway, CloudShell, and CloudWatch Logs, per AWS's published rate-tier terms. It's one shared 100 GB pool across all of those services and all Regions except China and GovCloud, not 100 GB per service.

Does the free tier roll over if I don't use it?

No. AWS Free Tier usage is calculated fresh each month, applied automatically to that month's bill, and unused capacity does not carry forward.

Why was I charged for traffic between two EC2 instances in the same Region?

If those two instances sit in different Availability Zones, that's DTAZ — AWS documents a charge for data transferred in and out across AZs for EC2, RDS, Redshift, DAX, ElastiCache, and ENIs, even though the traffic never leaves the Region.

Is cross-AZ traffic really billed on both ends?

AWS's FAQ describes the charge as applying to data transferred "in" and "out" across AZs, which is why a single gigabyte moving from AZ-a to AZ-b generates two separate charge events rather than one. For VPC Peering specifically, AWS's own pricing page confirms $0.01/GB in both the In and Out direction for AZ-crossing peered traffic.

Does putting traffic through a NAT Gateway make it free?

No, the opposite. AWS charges an hourly rate for the NAT Gateway plus a per-GB data processing fee for everything that passes through it, on top of whatever the destination's own data transfer charge is. A NAT Gateway adds a cost layer; it doesn't remove one.

Is traffic between S3 and EC2 in the same Region free?

Yes, when it's a direct path using the documented endpoints. AWS explicitly lists S3, EBS direct APIs, Glacier, DynamoDB, SES, SQS, Kinesis, ECR, SNS, and SimpleDB as free to transfer directly to EC2 instances in the same Region. It stops being free the moment another billed service, like a NAT Gateway or PrivateLink endpoint, sits in that path.

Why is CloudFront often cheaper than serving straight from S3 or EC2?

Two reasons AWS documents directly: the free tier is bigger (1 TB versus 100 GB), and the hop from your AWS origin into CloudFront's edge network is not charged at all. You're only paying CloudFront's own edge-to-user rate, not that rate plus a separate origin egress fee.

Does data transfer pricing depend on the source Region or the destination Region?

Source, for both DTO and DTIR. AWS's FAQ states this directly: "we charge for data transfer only based on the source Region." Where the data is headed doesn't change the price you pay to send it.

Are VPC endpoints free?

It depends which kind. Gateway endpoints, which only exist for S3 and DynamoDB, carry no hourly or data processing charge at all. Interface endpoints (PrivateLink) are billed both hourly per Availability Zone and per GB processed, on a tiered scale.

How much can Direct Connect actually save on a heavy, steady workload?

AWS's pricing documentation shows Direct Connect's data transfer out rate is calculated separately from standard internet DTO, based on source Region and Direct Connect location, and that inbound transfer is always $0.00/GB. Whether it nets out cheaper than standard DTO for your workload depends on your volume against the added port-hour cost, which AWS bills continuously whether or not data is flowing.

Can I get free egress if I'm leaving AWS for another provider?

Only through AWS's documented pre-approval process. You contact AWS Customer Support before the move, describe your plan, and if approved you get a temporary credit and 60 days to complete it. It is not automatic and does not apply retroactively to transfers you've already made.

Do researchers get a discount on data transfer out?

AWS documents an egress discount for qualified researchers and academic customers, capped at 15% of total monthly AWS spend. It requires checking eligibility through AWS's public-sector program rather than being applied by default.

Does the EU get different data transfer pricing?

EU customers may request reduced rates for eligible use cases under the EU Data Act, per AWS's documentation, but this goes through AWS Customer Support case by case rather than appearing as a published standard EU rate card.

Where do I actually see data transfer charges on my bill?

AWS points to the Billing & Cost Management Dashboard for a summary view, and Cost Explorer for a more granular, line-item breakdown specifically for data transfer costs.

What happens if my monthly data transfer is over 500 TB?

AWS's EC2 pricing documentation asks customers with more than 500 TB of data transfer a month to contact AWS directly rather than relying on the standard published tiers, implying custom or negotiated pricing at that scale.

Also Read:

AWS costs: The NAT gateway bill - the $32/month nobody planned

 AWS costs: Data transfer pricing - the map of what is free and what is not

 AWS costs: CloudWatch Logs ingestion - the log bill that outgrew the app

 AWS costs: Cross-AZ traffic - the invisible cent per gigabyte

 AWS costs: Unattached Elastic IPs and idle load balancers - the standing waste list

AWS costs: S3 request pricing - when storage is cheap but touching it is not

AWS costs: S3 storage classes decided honestly - IA, Glacier, Intelligent-Tiering

AWS costs: Glacier retrieval - the bill for wanting your data back

Revision note. Written September 2026, covering AWS's standard commercial Regions as documented on AWS's own pricing and FAQ pages at time of writing; GovCloud and China Regions follow separate terms not covered here. Rates, free-tier sizes, and endpoint pricing tiers are the kind of thing AWS revises without much fanfare, so it's worth a quick check against the live AWS pricing pages before you finalize a budget built on these numbers. If you're the one staring at an AWS invoice trying to figure out which line item ambushed you this month, you're not missing something obvious — this stuff genuinely is scattered across a dozen different pricing pages, and you deserve better than guessing Happy learning!, See you on next post.