AWSAmazon VPCNetworking

`aws_route` cost estimation

A single entry in a VPC route table. Routes are free, but they point traffic at targets like NAT gateways, transit gateways, and VPC peering, and those targets plus the data transfer they carry are where the cost is.

The aws_route resource creates one entry in a VPC route table: a destination CIDR block and a target that traffic to that destination should be sent to. Routes are free. AWS charges nothing for creating route table entries or for the routing lookups themselves.

The reason aws_route matters for cost is what it points at. A route is a decision about which paid networking component carries the traffic. Point a 0.0.0.0/0 route at an internet gateway and egress traffic bills at standard data transfer out rates (about 0.09 dollars per GB to the internet). Point it at a NAT gateway instead and you add both the NAT gateway hourly charge (about 0.045 dollars per hour, roughly 32 dollars per month) and NAT data processing (about 0.045 dollars per GB) on top of the egress. Point a route at a transit gateway attachment and every gigabyte crossing the TGW bills for data processing (about 0.02 dollars per GB) in addition to the attachment hourly fee. Point it at a VPC peering connection and, if the peers are in different Availability Zones or regions, inter-AZ or inter-region data transfer applies.

So the same free route can carry wildly different costs depending on its target. This is one of the most common places where a small Terraform change has a large bill impact: switching a private subnet default route from an internet gateway (impossible for private subnets without a NAT) to a NAT gateway, or routing more traffic through a transit gateway than expected, can add hundreds of dollars a month in data processing.

VPC endpoints change the math in the other direction. Routing S3 and DynamoDB traffic through a gateway VPC endpoint (which uses route table entries and is itself free) keeps that traffic off the NAT gateway, avoiding the per-GB NAT data processing charge entirely. This is a classic cost optimization: add endpoint routes to bypass paid NAT throughput.

c3x reports aws_route as free but treats the target it references as the cost driver, so the estimate reflects the NAT gateway, transit gateway, or peering data transfer the route enables.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id
}

# Free route, but it sends all outbound traffic through a paid NAT gateway.
resource "aws_route" "private_default" {
  route_table_id         = aws_route_table.private.id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.main.id
}

# Free route to a free gateway endpoint that keeps S3 traffic off the NAT.
resource "aws_route" "s3_endpoint" {
  route_table_id         = aws_route_table.private.id
  destination_prefix_list_id = aws_vpc_endpoint.s3.prefix_list_id
  vpc_endpoint_id            = aws_vpc_endpoint.s3.id
}

Pricing dimensions

What you actually pay for when you provision aws_route.

Dimension	Unit	What's being charged
VPC route	free	Route table entries and routing lookups are free. Cost comes entirely from the target. $0 (free)
NAT gateway (common target)	per hour + per GB processed	A default route to a NAT gateway adds an hourly charge plus per-GB data processing. $0.045/hour (~$32/month) + $0.045 per GB processed
Transit gateway (common target)	per attachment-hour + per GB	Routing through a transit gateway bills the attachment plus per-GB data processing. $0.05 per attachment-hour + $0.02 per GB processed
Internet data transfer out	per GB	Traffic to the internet via an internet gateway, billed as standard egress. $0.09 per GB (first 10 TB/month, us-east-1)

Optimization tips

Common ways to reduce aws_route cost without changing the workload.

Add gateway endpoint routes to bypass the NAT gateway

$0.045 per GB of S3/DynamoDB traffic that no longer hits NAT

Route S3 and DynamoDB traffic through free gateway VPC endpoints instead of the NAT gateway. This removes NAT data processing charges for that traffic, which is often the single largest NAT cost for data-heavy workloads.

Consolidate NAT gateways where availability allows

Each NAT gateway is roughly 32 dollars per month plus processing. Pointing multiple private subnets at a shared NAT (accepting cross-AZ data transfer) can be cheaper than one NAT per AZ for low-throughput workloads. Weigh the AZ resilience trade-off.

Keep peered and cross-VPC traffic in the same AZ

Routes to VPC peering connections incur inter-AZ data transfer when the source and destination are in different zones. Aligning workloads to the same AZ across peers avoids that per-GB charge.

Audit what each 0.0.0.0/0 route targets

The default route is the highest-leverage entry. Confirm whether it points at an internet gateway, NAT gateway, or transit gateway, because that choice sets the per-GB rate for all outbound traffic from the subnet.

FAQ

Do VPC routes cost anything?

No. Creating route table entries and performing routing lookups is free. The cost comes from the target the route points at, such as a NAT gateway, transit gateway, or internet gateway, and the data transfer that flows through it.

Why can changing a single route change my bill so much?

Because the target determines the per-GB and hourly charges. Sending a subnet default route through a NAT gateway adds hourly and per-GB data processing fees, while a transit gateway adds attachment and processing fees. The route itself is free; the path it selects is what bills.

How do routes help me save money?

Routing S3 and DynamoDB traffic through a gateway VPC endpoint keeps it off the NAT gateway, avoiding the per-GB NAT data processing charge. The endpoint and its routes are free, so this is a pure saving for data-heavy private subnets.

What is the difference between aws_route and aws_route_table?

aws_route_table is the container; aws_route is a single entry within it. Both are free. You can define routes inline in the route table or as separate aws_route resources for finer control. The cost is always in the targets, never the routes.