Egress cost reduction checklist: cutting the data transfer bill

Quick answer

Egress (data leaving AWS to the internet, and traffic crossing regions and availability zones) is billed per GB and can quietly become a major line item. The highest-impact reductions are: put a CDN in front of internet-facing traffic so cached bytes are cheaper and served fewer times from origin, keep chatty services in the same AZ to avoid cross-AZ charges, use VPC endpoints so traffic to AWS services skips NAT gateways and the internet, compress and cache responses, and keep data and compute co-located to avoid cross-region transfer. Egress is one of the most controllable AWS costs once you know where it accrues.

Data transfer is one of the most surprising lines on an AWS bill because it is invisible until it is large. Egress to the internet, traffic between availability zones, and cross-region transfer all bill per GB, and a chatty architecture or an uncached high-traffic site can run up thousands before anyone notices. The good news: egress is highly controllable. This checklist covers the highest-impact reductions in order.

Where egress accrues

Type	Typical rate	Common cause
Internet egress	Per GB, first tier highest	Serving content and APIs to users
Cross-AZ	About a cent per GB each way	Chatty services in different AZs
Cross-region	Per GB, varies by region pair	Replication, multi-region designs
NAT gateway data	Per GB processed plus hourly	Private subnets reaching the internet

1. Put a CDN in front of internet traffic

The single biggest lever for user-facing content: a CDN (CloudFront) caches responses at edge locations, so repeated requests are served from cache rather than fetched from origin every time. This cuts both origin egress and origin load, and CDN egress rates are often lower than direct internet egress. For any site or API serving significant traffic, this is the first move, detailed in the context of running a website on AWS.

2. Eliminate needless cross-AZ traffic

Traffic between availability zones costs about a cent per GB in each direction, which adds up fast for chatty internal services. Keep services that talk constantly in the same AZ where high availability allows, use topology-aware routing so requests prefer same-AZ endpoints, and be aware that load balancers and databases spanning AZs generate this traffic. The full mechanics are in inter-AZ data transfer cost.

3. Use VPC endpoints to skip NAT and the internet

Traffic from private subnets to AWS services (S3, DynamoDB, and others) routed through a NAT gateway pays NAT data processing charges plus the gateway's hourly cost. VPC endpoints (gateway endpoints for S3 and DynamoDB are free; interface endpoints have a small hourly and per-GB charge) route that traffic privately, avoiding NAT processing and internet egress. This also reduces how many NAT gateways you need, covered in how many NAT gateways do I need.

4. Compress, cache, and co-locate

Compress responses (gzip, Brotli) so fewer bytes leave, cache aggressively at every layer so data is transferred fewer times, and keep data and compute in the same region to avoid cross-region transfer entirely. Cross-region replication and multi-region architectures move data across region boundaries at per-GB rates, so replicate only what genuinely needs it. Co-location is free egress avoidance: traffic that never crosses a boundary is never billed for crossing it.

5. Measure and attribute

You cannot cut what you cannot see. Break down data transfer in Cost Explorer by type (internet, cross-AZ, cross-region, NAT) to find where it accrues, and tag resources so transfer is attributable to a team or service. Egress often hides inside larger service lines, so explicit analysis surfaces it, part of the wider set of hidden AWS costs to watch. Once you can see it, this checklist tells you where to act. For how transfer fits an API budget, see how much it costs to host an API.

FAQ

What is AWS egress cost?

Egress is the charge for data leaving AWS: traffic to the internet (billed per GB, with the first tier the most expensive), traffic between availability zones (about a cent per GB each way), and cross-region transfer (per GB, varying by region pair). NAT gateway data processing adds another per-GB charge for private subnets reaching the internet. Egress is billed per GB and can quietly become a major line item.

How do I reduce AWS egress costs?

The highest-impact steps: put a CDN in front of internet-facing traffic so cached bytes are served fewer times from origin, eliminate needless cross-AZ traffic by co-locating chatty services, use VPC endpoints so traffic to AWS services skips NAT gateways and the internet, compress and cache responses to move fewer bytes, and keep data and compute co-located to avoid cross-region transfer. Then measure and attribute to find remaining hotspots.

Does a CDN reduce egress costs?

Yes, significantly for user-facing content. A CDN like CloudFront caches responses at edge locations, so repeated requests are served from cache rather than fetched from origin every time, cutting origin egress and origin load. CDN egress rates are often lower than direct internet egress as well. For any site or API serving significant traffic, adding a CDN is typically the single biggest egress reduction.

How do VPC endpoints save egress costs?

Traffic from private subnets to AWS services routed through a NAT gateway incurs NAT data processing charges plus the gateway's hourly cost. VPC endpoints route that traffic privately: gateway endpoints for S3 and DynamoDB are free, and interface endpoints carry a small hourly and per-GB charge. This avoids NAT processing and internet egress, and can reduce how many NAT gateways you need to run.

Why is cross-AZ data transfer expensive?

Because it is billed at about a cent per GB in each direction, and chatty internal services spanning availability zones can generate enormous volumes of it continuously. Load balancers, databases, and microservices that constantly communicate across AZs quietly accumulate this charge. Keeping frequently-communicating services in the same AZ where high availability allows, and using topology-aware routing, reduces it substantially.

How do I find where egress cost comes from?

Break down data transfer in Cost Explorer by type (internet egress, cross-AZ, cross-region, and NAT processing) to see where it accrues, and tag resources so transfer is attributable to a team or service. Egress often hides inside larger service line items, so explicit analysis is needed to surface it. Once you can see where it comes from, the reduction checklist tells you which levers to pull.

What to do next

Spot data transfer cost in your architecture before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.