aws_vpn_gateway cost estimation

An aws_vpn_gateway (virtual private gateway, or VGW) is the AWS side anchor for a Site-to-Site VPN or a Direct Connect private virtual interface. Creating the gateway and attaching it to a VPC is free. AWS does not bill for the VGW itself.

The cost appears when you terminate an actual VPN connection on it. A Site-to-Site VPN connection (the aws_vpn_connection resource) is billed per connection-hour, about $0.05/hour, which is roughly $36/month for a single connection that stays up all month, plus standard data transfer out for traffic that leaves AWS over the tunnel. Inbound data over the VPN is free; outbound follows normal egress rates. So a VGW with one always-on connection anchors around $36/month before any transfer, and two tunnels for redundancy double the connection-hour charge.

The gateway is also the attachment point for Direct Connect private VIFs, where the cost is the Direct Connect port hours and data transfer rather than a VPN connection-hour. Either way the VGW is free scaffolding and the connection is the driver. c3x prices the VPN connections and transfer terminating on the gateway and treats the virtual private gateway as free.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_vpn_gateway" "main" {
  vpc_id          = aws_vpc.main.id
  amazon_side_asn = 64512

  tags = {
    Name = "main-vgw"
  }
}

Pricing dimensions

What you actually pay for when you provision aws_vpn_gateway.

Dimension	Unit	What's being charged
Virtual private gateway	free	The gateway and its VPC attachment have no charge. $0
Site-to-Site VPN connection	per connection-hour	Each VPN connection terminated on the gateway is billed hourly whether or not traffic flows. ~$0.05/hour (~$36/month)
Data transfer out	per GB	Traffic leaving AWS over the VPN follows standard egress rates; inbound is free. ~$0.09/GB egress

Optimization tips

Common ways to reduce aws_vpn_gateway cost without changing the workload.

Retire idle VPN connections

~$36/month per connection removed

A VPN connection is billed by the hour even when no traffic flows. Delete connections left over from migrations or testing to stop the ~$36/month per-connection charge.

Consolidate onto a transit gateway for many VPCs

If you are terminating one VPN per VPC, a transit gateway with a single VPN attachment can reduce the number of connection-hours you pay for at scale.

Use Direct Connect for sustained high volume

For steady, high-bandwidth on-prem traffic, Direct Connect data transfer rates are lower than VPN egress, which can offset the port cost over time.

FAQ

Does an AWS VPN gateway cost money?

The virtual private gateway itself is free. You pay for the Site-to-Site VPN connection terminated on it, about $0.05 per hour (~$36/month), plus standard data transfer out for traffic leaving AWS.

Is a VPN connection billed even when idle?

Yes. The connection-hour charge applies for every hour the VPN connection exists, regardless of whether traffic flows. Delete unused connections to stop it.

How much does a redundant two-tunnel VPN cost?

Each VPN connection is billed separately, so running two connections for redundancy roughly doubles the connection-hour charge to about $72/month, before data transfer.