aws_security_group cost estimation
Security groups are free. There is no charge for the group, its rules, or the traffic it allows. The cost sits in the resources it protects.
An aws_security_group is a stateful virtual firewall attached to ENIs, EC2 instances, load balancers, RDS databases, and most other VPC resources. It has no cost. AWS does not charge for security groups, ingress or egress rules, or the number of groups per account (there are quotas, but no price).
Because they are free, security groups are often overlooked in cost reviews, but two indirect effects matter. First, they gate the traffic that generates data transfer charges elsewhere: an egress rule that allows 0.0.0.0/0 does not cost anything by itself, but the cross-AZ or internet traffic it permits does. Second, overly broad rules are a security cost, not a dollar cost, and a breach is far more expensive than any line on the bill.
There is no optimization to do on the group itself. The useful move is to treat security groups as documentation of your traffic paths: if a group allows heavy cross-AZ traffic between tiers, that is a signal to check whether those tiers should be colocated to cut data transfer, which is a real cost.
c3x prices the resources a security group is attached to (instances, load balancers, databases) and treats the group as free, so your estimate reflects reality without a phantom charge.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "aws_security_group" "web" {
name = "web"
description = "Allow HTTP/HTTPS in, all out"
vpc_id = aws_vpc.main.id
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}Pricing dimensions
What you actually pay for when you provision aws_security_group.
| Dimension | Unit | What's being charged |
|---|---|---|
| Security group | free | The group and all its ingress and egress rules have no charge. $0 |
| Traffic it permits | per GB (billed elsewhere) | The data transfer the rules allow is billed on the resources and paths involved, not on the group. Cross-AZ: $0.01/GB each way |
Optimization tips
Common ways to reduce aws_security_group cost without changing the workload.
Use groups to spot expensive traffic paths
A rule allowing heavy traffic between two tiers in different AZs is a hint to colocate them and cut cross-AZ data transfer, which is a real charge.
Prefer endpoints over broad egress
Removes NAT processing on that trafficIf a group allows 0.0.0.0/0 egress so instances can reach S3 or ECR, a VPC endpoint keeps that traffic off the NAT Gateway and off internet egress.
FAQ
Do AWS security groups cost money?
No. Security groups, their rules, and the number you create are free. You only pay for the resources they are attached to and the data transfer the rules permit, which is billed elsewhere.
Is there a charge per security group rule?
No. There is no per-rule charge. There are account quotas on rules and groups, but no price attached to them.
Why does c3x show a security group as free?
Because it is. c3x costs the instances, load balancers, and databases the group protects, and correctly treats the group itself as a zero-cost resource.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including aws_security_group.