PrivateLink cost explained: private connectivity and its price

Quick answer

AWS PrivateLink provides private connectivity to AWS services, your own services, or SaaS, using interface endpoints (elastic network interfaces in your subnets). It bills an hourly charge per endpoint per Availability Zone plus a per-GB data processing charge for traffic through the endpoint. It pays off when it replaces more expensive or less secure paths, notably keeping AWS-service traffic off a NAT gateway whose per-GB charge is higher, and when private, secure connectivity is a requirement. At high AZ counts, the per-AZ hourly fee adds up, so consolidate where you can.

PrivateLink is how you reach AWS services, partner SaaS, or your own services privately, without the traffic ever touching the public internet. It is a security and architecture win, and it has a cost model worth understanding before you sprinkle endpoints everywhere, because the per-endpoint, per-AZ hourly fee can accumulate quietly across a large environment.

How PrivateLink is billed

Charge	What it covers
Endpoint hours	Per interface endpoint, per Availability Zone, per hour
Data processing	Per GB of data through the endpoint

An interface endpoint is a network interface in each Availability Zone you enable it in, and you pay an hourly rate for each one, so an endpoint spread across three AZs costs three times the per-AZ hourly rate. On top of that, data flowing through the endpoint is charged per GB. The hourly fee is the fixed cost of having the endpoint; the data processing fee scales with traffic.

When PrivateLink saves money

The clearest saving is replacing NAT gateway traffic. When your private resources reach AWS services through a NAT gateway, you pay the NAT per-GB data processing fee, which is higher than the PrivateLink equivalent for many services. Routing that traffic through an interface endpoint (or a free gateway endpoint for S3 and DynamoDB) can cut the bill. PrivateLink also avoids exposing traffic to the internet, which has its own security value.

When the cost adds up

Because you pay per endpoint per AZ, environments with many services each getting their own endpoints across many AZs and many VPCs can rack up a large fixed hourly cost, even at low traffic. Watch for endpoints created and forgotten, endpoints in AZs you do not need, and duplicate endpoints across VPCs that could be centralized. The fixed per-AZ fee, not the data charge, is usually what surprises people at scale, another of the unexpected charges that accumulate quietly.

Optimizing PrivateLink cost

Use free gateway endpoints for S3 and DynamoDB instead of interface endpoints where possible. Enable endpoints only in the AZs you actually use, consolidate endpoints via a shared-services VPC or centralized networking rather than duplicating them everywhere, and remove unused endpoints. Weigh the endpoint cost against the NAT or internet-path cost it replaces. Price your networking against the resource catalog so the per-AZ endpoint fees are visible before they multiply.

FAQ

How is AWS PrivateLink priced?

It bills two ways: an hourly charge for each interface endpoint in each Availability Zone it is enabled in, and a per-GB data processing charge for traffic through the endpoint. An endpoint spread across three AZs costs three times the per-AZ hourly rate, so the fixed per-AZ fee is the part that adds up across a large environment, on top of the traffic-based data processing charge.

When does PrivateLink save money?

When it replaces a more expensive path. Reaching AWS services through a NAT gateway incurs the NAT per-GB data processing fee, which is higher than the PrivateLink equivalent for many services, so routing that traffic through an interface endpoint (or a free gateway endpoint for S3 and DynamoDB) can cut the bill. PrivateLink also keeps traffic off the public internet, which has security value.

Why does PrivateLink cost add up at scale?

Because you pay per endpoint per Availability Zone, so environments with many services each getting endpoints across many AZs and many VPCs accumulate a large fixed hourly cost even at low traffic. Endpoints created and forgotten, endpoints in unnecessary AZs, and duplicate endpoints across VPCs are the usual culprits. The fixed per-AZ fee, not the data charge, is what surprises people at scale.

What is the difference between gateway and interface endpoints?

Gateway endpoints (for S3 and DynamoDB) route traffic privately at no hourly or per-GB charge, so they are free to use. Interface endpoints, which PrivateLink uses for most other services and for custom or SaaS services, bill an hourly fee per AZ plus per-GB data processing. Prefer free gateway endpoints where available, and use interface endpoints where a gateway endpoint is not an option.

How do I reduce PrivateLink cost?

Use free gateway endpoints for S3 and DynamoDB instead of interface endpoints, enable endpoints only in the Availability Zones you actually use, consolidate endpoints via a shared-services VPC or centralized networking rather than duplicating them across VPCs, remove unused endpoints, and weigh each endpoint's cost against the NAT or internet path it replaces so you only pay where it saves.

How does C3X help with PrivateLink cost?

C3X prices your VPC endpoints and networking from Terraform before you deploy, so the per-AZ hourly fees of PrivateLink interface endpoints are visible in the pull request. That lets you catch duplicated or unnecessary endpoints and confirm that an endpoint actually saves against the NAT or internet path it replaces, before the fixed per-AZ cost multiplies across your environment.

What to do next

Price PrivateLink endpoints before they multiply across your VPCs. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.