Private IP vs public IP data transfer cost: the free path you might be missing

Quick answer

On AWS, data transfer between resources in the same availability zone over private IPv4 addresses is free. The same traffic sent over public IPv4 or Elastic IP addresses is charged, typically about $0.01 per GB in each direction, even when both resources are in the same region. So two instances talking to each other by public IP pay for traffic that would be free over private IP. This catches teams whose applications resolve to public endpoints out of habit. The fix: always use private IPs and internal DNS for resource-to-resource traffic within AWS, so same-AZ traffic stays free instead of being billed per GB.

One of the least-known AWS data transfer rules is that the address you use changes the price. Traffic between resources over private IP addresses within the same availability zone is free, but the identical traffic over public or Elastic IP addresses is charged, even when both endpoints sit in the same region. Applications that reach each other by public endpoint out of habit pay for traffic that should cost nothing.

The pricing difference

Path	Cost
Private IP, same AZ	Free
Private IP, cross-AZ	~$0.01/GB each direction
Public or Elastic IP	~$0.01/GB each direction (even same AZ)

Same-AZ private IP traffic is free. Cross-AZ private IP traffic costs about $0.01 per GB each way. But traffic over a public or Elastic IP is charged about $0.01 per GB in each direction regardless of whether the resources are in the same AZ, because using the public address routes the traffic out through the internet gateway path rather than staying on the private network. So the public address turns what could be free same-AZ traffic into a billable flow.

How this happens by accident

The trap is applications that connect to each other using public DNS names or public IP addresses. An application that reaches its database, cache, or another service by its public endpoint, perhaps because the configuration used a public hostname that resolves to a public IP, pays data transfer on every byte, even if the two are in the same AZ. The same connection made over the private IP or an internal DNS name that resolves to the private address would be free within the AZ. The application works identically either way, so the cost difference is invisible until it appears on the bill.

Keeping traffic on the private path

Use private IP addresses and internal DNS for all resource-to-resource communication within AWS. Within a VPC, resources should reference each other by private IP or by internal DNS names that resolve to private addresses, not public ones. For services accessed by DNS name, ensure the name resolves to the private IP inside the VPC, which AWS internal DNS does automatically for many services. Avoid routing internal traffic through public endpoints, load balancer public IPs, or NAT unnecessarily. This keeps same-AZ traffic free and cross-AZ traffic at the lower private rate.

Where it matters most

The saving scales with internal traffic volume. A chatty application exchanging terabytes with its database and cache over public IPs pays for all of it, while the private path within the AZ would be free. This is closely related to the broader inter-AZ transfer anddata transfer rules, and it is one of theunexpected charges that a simple addressing fix eliminates entirely.

Because the cost depends on addressing choices you control, it is worth getting right before deployment. Price your network topology against the resource catalog so the traffic stays on the free private path rather than an accidentally billable public one.

FAQ

Is data transfer over private IPs free on AWS?

Between resources in the same availability zone, yes, private IPv4 traffic is free. Cross-AZ private IP traffic costs about $0.01 per GB each direction. The same traffic over public or Elastic IP addresses is charged about $0.01 per GB each way even within a single AZ, because the public address routes traffic out through the internet gateway path rather than staying on the private network.

Why does using a public IP cost more for internal traffic?

Because reaching a resource by its public or Elastic IP routes the traffic out through the internet gateway path rather than staying on the private VPC network, so AWS charges data transfer of about $0.01 per GB each direction, even when both resources are in the same availability zone. The same connection over the private IP would be free within the AZ. The application works identically, so the cost difference is easy to miss.

How do I keep AWS internal traffic free?

Use private IP addresses and internal DNS for all resource-to-resource communication within AWS. Reference resources by their private IP or by internal DNS names that resolve to private addresses, not public ones, and avoid routing internal traffic through public endpoints or NAT unnecessarily. This keeps same-AZ traffic free and cross-AZ traffic at the lower private rate instead of the public-path charge.

How does traffic accidentally go over public IPs?

Usually through configuration that uses public DNS names or public IP addresses. An application reaching its database, cache, or another service by a public endpoint pays data transfer on every byte, even in the same AZ, because the public hostname resolves to a public IP. The same connection over the private IP or internal DNS name would be free within the AZ, but the application behaves the same, hiding the cost.

How much can using private IPs save?

It scales with internal traffic volume. A chatty application exchanging terabytes with its database and cache over public IPs pays about $0.01 per GB each direction for all of it, while the private path within the same AZ would be free. For high-volume internal traffic that is currently going over public endpoints, switching to private addressing can eliminate a significant, entirely avoidable data transfer bill.

How does C3X help with data transfer addressing cost?

C3X prices your network topology from Terraform before you deploy, so the data transfer implications of how resources reach each other are visible in the pull request. That helps you catch designs that would route internal traffic over public IPs and keep resource-to-resource communication on the free private path at design time, rather than discovering the avoidable per-GB charges after the traffic starts flowing.

What to do next

Keep internal traffic on the free private path. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.