aws_customer_gateway cost estimation

An aws_customer_gateway is a metadata resource that describes the far end of a Site-to-Site VPN: your on-premises router or firewall's public IP address and, for dynamic routing, its BGP ASN. It is purely a configuration record. Creating a customer gateway is free, and you can create as many as you have remote sites without any charge.

There is no cost in the customer gateway itself. It only becomes relevant to the bill when you pair it with a virtual private gateway or transit gateway through a VPN connection (the aws_vpn_connection resource). That connection is what bills, at roughly $0.05/hour per connection (~$36/month if always on), plus standard data transfer out for traffic that leaves AWS over the tunnel. The customer gateway contributes none of that; it just names where the tunnel terminates on your side.

Because it is free and stateless, there is no optimization to do on the customer gateway directly. The cost decisions live on the VPN connection: how many connections and tunnels you run, and how much traffic egresses over them. c3x prices the VPN connections and their data transfer, and treats the customer gateway as the free record it is.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_customer_gateway" "on_prem" {
  bgp_asn    = 65000
  ip_address = "203.0.113.10"
  type       = "ipsec.1"

  tags = {
    Name = "on-prem-datacenter"
  }
}

Pricing dimensions

What you actually pay for when you provision aws_customer_gateway.

Dimension	Unit	What's being charged
Customer gateway	free	The configuration record describing the on-premises endpoint has no charge. $0
Site-to-Site VPN connection	per connection-hour	The VPN connection that references this gateway is what bills, per hour. ~$0.05/hour (~$36/month)
Data transfer out	per GB	Traffic leaving AWS over the VPN follows standard egress rates. ~$0.09/GB egress

Optimization tips

Common ways to reduce aws_customer_gateway cost without changing the workload.

Delete stale gateway records with their connections

~$36/month per unused connection

A customer gateway is free, but the VPN connections that reference it are not. Remove records for decommissioned sites so their connections do not linger and keep billing.

Reuse one customer gateway across tunnels

A single customer gateway can back multiple tunnels to the same on-premises device, so you do not need duplicate records or extra billed components for redundancy.

Prefer dynamic (BGP) routing for multi-site scale

BGP-based routing simplifies adding sites and can reduce the number of separately managed connections you pay for as the topology grows.

FAQ

Does an AWS customer gateway cost money?

No. A customer gateway is a free configuration record of your on-premises VPN endpoint. Cost comes from the Site-to-Site VPN connection that references it, billed at about $0.05 per hour plus data transfer.

What is the difference between a customer gateway and a VPN gateway?

The customer gateway describes your on-premises side (its public IP and ASN); the virtual private gateway is the AWS side. Both are free. The VPN connection that links them is the billed component.

Can I create customer gateways for planning without being charged?

Yes. Customer gateways cost nothing on their own, so you can define them ahead of time. Charges begin only when a VPN connection using the gateway is created.