aws_vpc cost estimation | C3X Resources

An aws_vpc is the isolated virtual network your AWS resources live in. Creating a VPC is free, and so are the building blocks that shape it: subnets, route tables, internet gateways, security groups, and network ACLs. AWS does not charge for the network itself.

The cost of a VPC is entirely the paid infrastructure inside and at its edge. The usual suspects are NAT Gateways (an hourly charge plus per-GB processing that surprises many teams), Interface VPC endpoints, VPN and Direct Connect connections, and above all data transfer: cross-AZ traffic, internet egress, and cross-region traffic. A VPC with private subnets almost always has at least one NAT Gateway, which alone runs about $32/month plus $0.045/GB processed, so the "free" network quietly anchors a real bill.

The highest-value VPC cost decisions are architectural: how many NAT Gateways you run (one per AZ for availability versus one shared), whether you use free S3 and DynamoDB gateway endpoints to bypass NAT, and keeping chatty services in the same AZ to avoid cross-AZ transfer. c3x prices the NAT Gateways, endpoints, and other billed components in your VPC and treats the VPC, subnets, and route tables as the free scaffolding they are.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "main"
  }
}

Pricing dimensions

What you actually pay for when you provision aws_vpc.

Dimension	Unit	What's being charged
VPC and subnets	free	The network, subnets, route tables, internet gateway, and security groups have no charge. $0
NAT Gateway (typical inside)	per hour + per GB	The most common paid component in a VPC with private subnets. ~$0.045/hour + $0.045/GB processed
Data transfer	per GB	Cross-AZ, internet egress, and cross-region traffic generated by resources in the VPC. Cross-AZ: $0.01/GB each way

Optimization tips

Common ways to reduce aws_vpc cost without changing the workload.

Add free gateway endpoints for S3 and DynamoDB

Eliminates NAT processing on S3/DynamoDB

Gateway endpoints route S3 and DynamoDB traffic off the NAT Gateway at no cost, removing the per-GB NAT processing fee on that traffic.

Right-size NAT Gateway count

~$32/month per gateway removed

One NAT Gateway per AZ gives availability; consolidating to one shared gateway cuts hourly cost if you can accept the single-AZ dependency.

Keep chatty tiers in one AZ

Cross-AZ traffic is billed both ways. Colocating services that talk to each other frequently removes that transfer charge.

FAQ

Does an AWS VPC cost money?

No. The VPC, its subnets, route tables, internet gateway, and security groups are all free. Cost comes from paid components inside it like NAT Gateways, VPC endpoints, VPN connections, and data transfer.

What is usually the biggest cost in a VPC?

NAT Gateways and data transfer. A NAT Gateway bills hourly plus per-GB processing, and cross-AZ, internet, and cross-region traffic add per-GB transfer charges that scale with usage.

How do I reduce VPC cost?

Add free S3 and DynamoDB gateway endpoints to bypass NAT processing, right-size how many NAT Gateways you run, and colocate chatty services in one AZ to avoid cross-AZ transfer.