Does a VPC cost money? What is free and what is not

Quick answer

The VPC itself is free, and so are subnets, route tables, security groups, network ACLs, internet gateways, and peering connections (though peering data transfer is billed). What costs money is what you run inside and attach to it: NAT gateways (hourly plus per-GB processing, often the biggest surprise), VPC endpoints (interface endpoints bill hourly plus data, gateway endpoints for S3 and DynamoDB are free), Elastic IPs in some cases, and data transfer across zones, regions, and out to the internet. So creating a VPC is free; the traffic and gateways inside it are where the bill comes from.

A common question when learning AWS networking: does creating a VPC cost anything? The reassuring answer is no, the VPC and most of its structural pieces are free. The costs come from specific components you attach for connectivity and from data moving around, not from the network container itself. Knowing which is which prevents both surprise bills and needless worry.

What is free

Component	Cost
The VPC itself	Free
Subnets	Free
Route tables	Free
Security groups and network ACLs	Free
Internet gateway	Free (data transfer billed separately)
VPC peering connection	Free to create (data transfer billed)

You can build an entire VPC network structure, subnets, routing, security groups, an internet gateway, and pay nothing for that scaffolding. Like security groups and IAM, these are free control-plane constructs. The charges begin when traffic flows and when you add certain gateway components.

What costs money

Component	What you pay
NAT gateway	Hourly fee plus per-GB data processing
Interface VPC endpoints	Hourly per endpoint plus per-GB data
Gateway endpoints (S3, DynamoDB)	Free
Data transfer	Cross-AZ, cross-region, and internet egress

The NAT gateway is the usual surprise: it bills both an hourly rate and a per-GB processing charge on all traffic through it, so a busy NAT gateway can cost more than the instances behind it. Interface VPC endpoints (PrivateLink) also bill hourly plus per-GB, while gateway endpoints for S3 and DynamoDB are free. And all the usual data transfer charges apply to traffic leaving the VPC.

Watching the NAT gateway

Because the NAT gateway is often the largest VPC-related cost, it is worth managing deliberately. Use gateway endpoints for S3 and DynamoDB so that traffic bypasses the NAT gateway entirely (free instead of per-GB), consolidate NAT gateways where high availability does not require one per zone (weighing cross-AZ transfer against extra NAT gateways), and be aware that per-GB processing applies even to traffic to AWS services if it routes through the NAT. These choices can move a meaningful amount of money.

The bottom line

Creating and structuring a VPC is free; you pay for NAT gateways, interface endpoints, Elastic IP edge cases, and data transfer. So do not hesitate to design a proper VPC with multiple subnets and good segmentation, that structure costs nothing, but do plan NAT gateway placement and endpoint usage deliberately, since those are the real cost drivers. Pricing the networking components before you deploy, against the resource catalog, shows exactly what your VPC design will cost. For dedicated connectivity, see Direct Connect versus VPN.

FAQ

Does creating a VPC cost money?

No. The VPC itself is free, and so are subnets, route tables, security groups, network ACLs, internet gateways, and creating peering connections. These are free structural constructs. Costs come only from specific components you attach (NAT gateways, interface VPC endpoints) and from data transfer, not from the VPC container or its scaffolding. You can build a full network structure and pay nothing for it.

What parts of a VPC cost money?

NAT gateways (an hourly fee plus per-GB data processing, often the biggest surprise), interface VPC endpoints (hourly per endpoint plus per-GB data), Elastic IPs in some cases, and data transfer across availability zones, across regions, and out to the internet. Gateway endpoints for S3 and DynamoDB are free. So the traffic and gateways inside the VPC drive the bill, not the VPC itself.

Why is a NAT gateway so expensive?

A NAT gateway bills both an hourly rate and a per-GB processing charge on all traffic that passes through it, so a busy NAT gateway can cost more than the instances behind it. High-volume outbound traffic (or traffic to AWS services routed through the NAT) accumulates per-GB charges quickly. Using gateway endpoints for S3 and DynamoDB lets that traffic bypass the NAT gateway for free.

Are VPC endpoints free?

It depends on the type. Gateway endpoints for S3 and DynamoDB are free and let traffic to those services bypass the NAT gateway. Interface endpoints (PrivateLink) are not free: they bill an hourly rate per endpoint plus a per-GB data-processing charge. So use gateway endpoints wherever available for cost savings, and weigh interface-endpoint cost against the NAT-gateway traffic they replace.

How do I reduce VPC costs?

Use free gateway endpoints for S3 and DynamoDB so that traffic bypasses the NAT gateway, consolidate NAT gateways where high availability does not require one per zone (weighing cross-AZ transfer against extra gateways), minimize cross-zone and cross-region data transfer, and be deliberate about interface endpoints. The VPC structure is free, so the savings come from managing NAT gateways, endpoints, and data transfer.

How does C3X help with VPC cost?

C3X prices VPC networking components like NAT gateways and interface endpoints from your Terraform before deploy, so the cost of a networking design is visible in the pull request. Since NAT gateways are a common surprise, seeing their hourly and per-GB cost at design time helps you place them deliberately and use free gateway endpoints before the design ships.

What to do next

See what your VPC networking design will cost before you deploy. C3X prices your resources against a live catalog. Start with the quickstart.