AWS Data Transfer Costs: The Complete 2026 Map

Prices below are 2026 US-region list prices for planning purposes. Exact rates vary by region and change over time — always confirm against the AWS Data Transfer pricing page for your account's regions before budgeting.

Ingress — data coming into AWS from the public internet — is free across every service. Egress is where the meter starts. Standard internet egress from EC2, S3, or most other services costs $0.09/GB for the first 10 TB per month, after a 100 GB/month free allowance (AWS Data Transfer Pricing, 2026 ). Rates step down at volume: $0.085/GB from 10–50 TB, $0.07/GB from 50–150 TB, and $0.05/GB above 150 TB.

These tiers are cumulative across most services in a single AWS account and region — they're not per-instance. A workload that sends 5 TB out through EC2 and 6 TB out through S3 in the same month combines toward the same volume tier, which is easy to miss when reading per-service cost breakdowns in isolation.

Moving data from one AWS region to another — say, replicating from us-east-1 to eu-west-1 — costs roughly $0.02/GB out of the source region for transfers between US regions, with rates rising for longer geographic hops. Transfers to or from Asia-Pacific or South America regions commonly run $0.02–$0.09/GB depending on the exact pair (AWS EC2 Data Transfer, 2026 ). There is no ingress charge on the receiving region — the source region bills the full amount.

The classic source of surprise inter-region charges is cross-region database replication and disaster-recovery replication. A 500 GB database replicated daily to a standby region at $0.02/GB generates roughly $300/month — and on the bill it shows up folded into "EC2-Other" or the source database service, not labeled "replication." Multi-region active-active architectures multiply this by every region pair that synchronizes.

This is the charge most engineers don't know exists. Traffic between two availability zones in the same region — even over private IP addresses — costs $0.01/GB on the sending side and $0.01/GB on the receiving side, for $0.02/GB round-trip (AWS VPC Pricing, 2026 ). It applies to EC2-to-EC2 traffic, load balancer to backend, and database replica traffic whenever the two endpoints land in different AZs.

Multi-AZ deployments are the recommended pattern for availability, which means most production architectures pay this fee by design. A microservices architecture calling across AZs constantly can accumulate meaningful cross-AZ traffic even at modest request volumes — and because it never shows up as a distinct "cross-AZ" line item on the bill (it's bundled into EC2-Other or ELB usage types), most teams never notice it's there until they specifically go looking.

Cross-AZ charges apply symmetrically to load balancers too. An Application Load Balancer routing to targets in a different AZ than the client entry point incurs the same $0.01/GB each direction, on top of the ALB's own per-GB processing fee.

Within a single availability zone, traffic between resources over private IP addresses is free — no charge in either direction. But the same two resources, in the same AZ, talking over a public IP or Elastic IP instead of the private one, get charged $0.01/GB in each direction (AWS EC2 Data Transfer, 2026 ). This is purely a routing-path charge, not a distance charge — the bytes might travel the same physical path, but which IP address you use to reach the peer determines whether AWS bills for it.

This trips up teams that reference RDS, ElastiCache, or peer EC2 instances by public endpoint out of habit, or because security group rules were built around public addressing. Switching application config to use private DNS names or private IPs for same-VPC traffic is a zero-cost, zero-risk fix that eliminates the charge entirely.

NAT Gateway is the single most avoidable AWS data transfer charge. Every byte that passes through a NAT Gateway — in either direction — incurs a $0.045/GB data processing fee, layered on top of whatever egress or inter-region rate already applies (AWS VPC Pricing, 2026 ). For private-subnet traffic headed to the public internet, that turns the effective rate from $0.09/GB into $0.135/GB — a 50% markup just for routing through the gateway.

The processing fee applies regardless of destination. Private-subnet instances calling S3 or DynamoDB through a NAT Gateway pay the $0.045/GB fee even though those services are inside AWS — there's no discount for "AWS-to-AWS" traffic routed through NAT. A team pushing 10 TB/month through a single NAT Gateway pays roughly $450/month in processing fees alone, on top of whatever the underlying egress or transfer costs.

NAT Gateway also bills an hourly charge per gateway (roughly $0.045/hr) independent of traffic, and multi-AZ NAT deployments — one gateway per AZ, the recommended pattern for availability — multiply that fixed cost by the number of AZs in use. For the full breakdown of NAT Gateway pricing and how it stacks with everything else in this article, see our dedicated AWS NAT Gateway pricing deep dive.

The fix for a large share of NAT Gateway spend is routing AWS-to-AWS traffic through VPC endpoints instead. There are two flavors, priced very differently.

Gateway Endpoints (S3 and DynamoDB)

Gateway Endpoints are free — $0/hr and $0/GB — and route traffic to S3 or DynamoDB entirely within the AWS network, bypassing NAT Gateway and its $0.045/GB fee completely. There is essentially no reason not to use one if your workload talks to S3 or DynamoDB from a private subnet.

Interface Endpoints (PrivateLink)

For every other AWS service — SQS, SNS, Secrets Manager, ECR, and most others — Interface Endpoints (built on PrivateLink) cost $0.01/hr per endpoint per AZ plus $0.01/GB processed (AWS PrivateLink Pricing, 2026 ). That's still a large discount versus the $0.045/GB NAT Gateway processing fee for any meaningful volume — the endpoint pays for itself well under 1 TB/month for a single busy service.

VPC peering and Transit Gateway

VPC peering within the same region is free. Cross-region peering costs $0.01/GB per direction. Transit Gateway, used to hub-and-spoke many VPCs together, charges $0.02/GB for all data processed — even within a single region — plus an hourly attachment fee per VPC. Centralized routing through Transit Gateway is convenient at scale, but it is never the cheapest option versus direct VPC peering for a small number of VPCs.

S3 Transfer Acceleration

Transfer Acceleration routes uploads and downloads through AWS's CloudFront edge network to speed up transfers over long distances, at an add-on cost of roughly $0.04–$0.08/GB on top of standard S3 transfer rates (AWS S3 Pricing, 2026 ). It only makes sense for latency-sensitive, geographically distant transfers — AWS itself won't charge the acceleration fee if it can't actually speed up the transfer versus a direct upload.

CloudFront egress

CloudFront egress to the internet costs $0.085/GB for the first 10 TB — slightly cheaper than the $0.09/GB direct EC2 or S3 internet egress rate (AWS CloudFront Pricing, 2026 ). The per-GB discount is modest, but the real saving comes from edge caching: every request served from a CloudFront edge location is a request that never touches origin egress at all. Traffic from an origin to CloudFront is also free, so fronting an S3 bucket or ALB with CloudFront is close to a strict cost improvement for any internet-facing, cacheable traffic.

Direct Connect

Direct Connect is a dedicated physical network link from on-premises infrastructure into AWS. Egress over a Direct Connect connection runs around $0.02/GB — a large discount off the $0.09/GB standard internet rate — but requires a fixed hourly port fee (around $0.03/hr for a 1 Gbps port) regardless of usage (AWS Direct Connect Pricing, 2026 ). The math only favors Direct Connect above roughly 5 TB/month of sustained transfer, where the per-GB savings outweigh the fixed port cost.

Traffic between AWS services in the same region is generally free when it stays inside the AWS network — EC2 reading from S3 in the same region, for example, costs $0/GB, as does traffic between most AWS services within a region over the AWS backbone. The moment that traffic crosses a region boundary, standard inter-region rates apply.

S3 Cross-Region Replication (CRR) is the most common source of this charge: every byte replicated to a bucket in another region pays the ~$0.02/GB inter-region rate on top of any replication or request fees. A 1 TB bucket replicated to a second region for disaster recovery adds roughly $20/month in transfer alone, scaling linearly with bucket growth. Same-Region Replication (SRR), by contrast, has no data transfer charge since it never leaves the region.

Database read replicas follow the same pattern: an RDS or Aurora replica in the same region as its primary transfers data for free; a cross-region replica pays standard inter-region rates on every byte of replication traffic, continuously, for as long as the replica exists. If you're evaluating RDS versus Aurora for a replica-heavy workload, our RDS vs Aurora cost comparison covers how replication architecture changes the total bill.

Most AWS data transfer overspend traces back to a handful of repeatable patterns. Architecture fixes, not rate negotiation, are what move the needle here.

1. NAT Gateway routing AWS-to-AWS traffic

If private-subnet workloads talk to S3 or DynamoDB through a NAT Gateway, switch to a free Gateway Endpoint. For every other AWS service, an Interface Endpoint at $0.01/hr + $0.01/GB almost always beats the $0.045/GB NAT Gateway processing fee at any meaningful volume.

2. Chatty multi-AZ microservices

High-frequency service-to-service calls that cross AZ boundaries pay $0.02/GB round-trip on every hop. Where latency and availability requirements allow it, keeping tightly-coupled services that communicate constantly within a single AZ (with cross-AZ failover only, not steady-state chatter) removes the charge for the bulk of traffic.

3. Public/Elastic IP used for same-VPC traffic

Referencing peer resources, databases, or caches by public endpoint instead of private DNS name turns free same-AZ traffic into $0.02/GB round-trip for no functional benefit. Auditing application connection strings for public endpoints inside the same VPC is a five-minute fix with immediate savings.

4. Direct-to-internet egress instead of CloudFront

Serving static assets, API responses, or downloads directly from EC2 or S3 to the internet misses both the small CloudFront per-GB discount and, more importantly, the cache-hit reduction in origin traffic. Fronting internet-facing traffic with CloudFront is close to free to implement and typically cuts origin egress substantially through caching alone.

5. Uncompressed payloads

Enabling gzip or Brotli compression on API responses and static assets typically shrinks JSON and text payloads by 60–80%. Since every egress and cross-AZ rate is priced per GB, cutting payload size cuts the bill proportionally — and it's a configuration change, not an architecture change.

6. Cross-region replication that doesn't need to be cross-region

Disaster-recovery and multi-region replication are legitimate, but teams sometimes default to cross-region replicas for workloads that never need cross-region failover. Confirming the actual availability requirement before standing up a cross-region replica avoids paying continuous inter-region transfer fees for a capability that isn't used.

7. Transit Gateway where VPC peering would do

Transit Gateway's $0.02/GB processing fee applies even to same-region traffic. For a handful of VPCs, direct VPC peering (free in-region) is cheaper and simpler; Transit Gateway earns its cost once the number of VPC-to-VPC connections makes direct peering unmanageable.

These issues rarely show up in isolation — a team over-provisioning compute usually hasn't audited its network topology either. Our guide on cloud waste and overprovisioning covers the broader pattern, and why is my AWS bill so high walks through diagnosing which category — compute, storage, or transfer — is actually driving growth.

Start in Cost Explorer filtered to "Data Transfer" usage types, and break the total down by usage-type code: EC2 usage types beginning with DataTransfer-Out-Bytes are internet egress, DataTransfer-Regional-Bytes is cross-AZ, and DataTransfer-Out-Bytes under VPC/NAT usage types is NAT Gateway processing. AWS splits these across EC2, S3, RDS, and VPC line items rather than a single "network" category, so the true total is usually higher than what a first glance at the bill suggests.

Enable VPC Flow Logs on your busiest VPCs to see which specific resources and AZ pairs generate the most cross-AZ traffic — this is the fastest way to find chatty microservices before they show up as an unexplained line-item increase. For a fast, model-based estimate that doesn't require digging through Cost Explorer usage types, the SpendArk cloud cost calculator models AWS transfer costs across egress, cross-AZ, and NAT Gateway paths so you can see the total before it hits the bill.

As a planning rule of thumb, data transfer typically lands in the 6–12% range of total AWS spend for a typical web or API workload (CloudZero, 2025 ), but that figure climbs well past 20% for data-heavy, multi-region, or streaming workloads — see our video streaming cloud cost breakdown for an example of a transfer-dominated bill.