AWS Site-to-Site VPN cost: cheap per connection, plus egress

Quick answer

Site-to-Site VPN bills about $0.05 per VPN connection-hour (roughly $36/month per connection) plus standard data transfer out. It is a cheap, fast way to link on-premises networks to AWS over the internet. For high, steady traffic or consistent performance, Direct Connect is better; for low or intermittent connectivity, VPN wins on cost and simplicity.

AWS Site-to-Site VPN creates an encrypted IPsec tunnel between your network and a VPC over the public internet. It is the low-cost, quick-to-provision way to connect on-premises to AWS, and its pricing reflects that: a small per-connection hourly fee plus the usual data transfer.

Per connection-hour plus egress

Dimension	Rate (approximate)
VPN connection	~$0.05 / hour (~$36 / month)
Data transfer out	Standard AWS egress rates

Each VPN connection costs about five cents an hour whether or not traffic flows, and data leaving AWS is billed at standard internet egress rates, since the traffic travels over the public internet. There is no discounted egress as with Direct Connect.

Where VPN fits

VPN suits low-to-moderate, intermittent connectivity: connecting a branch office, a small on-premises footprint, or a temporary link, where its low fixed cost and quick setup beat provisioning a dedicated line. It runs over commodity internet, so performance is internet-dependent rather than guaranteed.

VPN vs Direct Connect

For high, steady traffic or consistent low-latency performance, Direct Connect is better despite its port fee, because its discounted egress pays back at volume and its performance is predictable. A common pattern uses VPN as an inexpensive backup for a Direct Connect primary. Match the link to the traffic volume and the performance requirement, and remember the egress line is the same as any internet transfer, covered in AWS data transfer costs.

FAQ

How much does AWS Site-to-Site VPN cost?

About $0.05 per VPN connection-hour, roughly $36 per month per connection, plus standard data transfer out at internet egress rates. The connection fee applies whether or not traffic flows, and there is no discounted egress as with Direct Connect.

Is Site-to-Site VPN cheaper than Direct Connect?

For low or intermittent traffic, yes, because it has only a small hourly fee and no port fee, and it is quick to set up. Direct Connect becomes cheaper at high, steady egress volume, where its discounted per-gigabyte transfer offsets its fixed port fee.

Does AWS VPN charge for data transfer?

Yes, standard AWS data transfer out rates apply to traffic leaving AWS over the VPN, since it travels over the public internet. Data into AWS is generally free. Unlike Direct Connect, there is no discounted egress rate.

When should I use a VPN instead of Direct Connect?

For low-to-moderate, intermittent connectivity such as a branch office, small on-premises footprint, or temporary link, where the low fixed cost and quick setup beat a dedicated line. Use Direct Connect for high, steady traffic or guaranteed performance.

Can I use VPN as a backup for Direct Connect?

Yes, and it is a common pattern. A Site-to-Site VPN provides an inexpensive failover path over the internet for a Direct Connect primary, so if the dedicated link fails, traffic continues over the VPN at a small additional standing cost.

Does C3X estimate Site-to-Site VPN cost?

C3X prices the aws_vpn_connection resource from your Terraform, including the per-connection hourly fee, so the fixed cost appears before deploy. Data transfer out depends on traffic, which you provide as a usage assumption.

What to do next

Price your connectivity before you provision it. C3X reads your Terraform and prices VPN and the rest of your stack against a live catalog. Start with the quickstart.