Data Transfer Costs: Egress, Cross-Zone and NAT Charges

Data transfer cost is what a cloud provider charges to move data: out to the internet, between regions, between availability zones in a region, and through managed network services such as NAT gateways. It is hard to see because it rarely belongs to one resource. It shows up as separate billing lines that are hard to assign to an owner.

The shape of the charges

The three major providers price transfer along the same axes, with different details:

• Into the cloud is free on Google Cloud (“ingress pricing is still free”) and on Azure (“Data Transfer In: Free”).
• Within a zone over private addresses is free: AWS does not charge for transfer between EC2, RDS, Redshift, ElastiCache, and network interfaces in the same availability zone; Google Cloud does not charge VM-to-VM traffic in the same zone on internal addresses in the same VPC; Azure lists transfer within the same availability zone as free.
• Between zones in a region is charged. AWS charges transfer in and out of EC2, RDS, Redshift, DAX, ElastiCache, and network interfaces across availability zones in the same Region in each direction, and transfer to or from a public or Elastic IPv4 address is charged even inside the Region. Google Cloud charges VM-to-VM traffic to a different zone in the same region, and notes that all traffic to external IPv4 addresses leaves the zone regardless of destination.
• To the internet and between regions is charged per GB, at rates that vary by region. AWS provides 100 GB per month of free transfer out to the internet, aggregated across all services and regions except China and GovCloud.

NAT gateways: the charge on top

On AWS, a NAT gateway is billed for every hour it is provisioned, partial hours counted as full hours, plus a charge for each GB it processes regardless of source or destination, and standard data transfer charges still apply to that traffic. Two consequences:

1. Traffic from private subnets to AWS services such as S3 can pay a NAT processing charge it does not need to. Gateway VPC endpoints for S3 and DynamoDB carry no additional charge and remove that traffic from the NAT path.
2. Stopping the instances behind a NAT gateway removes their processing charges but not the gateway’s hourly charge. AWS’s own advice is that if you no longer wish to be charged for a NAT gateway, delete it.

Load balancers follow the same pattern. AWS charges for each hour or partial hour that an Application Load Balancer or Network Load Balancer is running, plus capacity units for the traffic it handles, so an idle load balancer in front of a stopped environment still bills its hourly charge. A schedule that stops the instances does not stop either of these; they have to be deleted and recreated, or accepted as the fixed cost of keeping the environment’s network in place.

Architecture choices that move the number

• Keep chatty services and their databases in the same zone where your availability design allows, or accept cross-zone cost as the price of resilience deliberately.
• Put caches and CDNs in front of public downloads, so repeated reads do not each cross the internet boundary from the origin.
• Compress and batch cross-region replication; replicate only what recovery actually needs.
• Route AWS-service traffic through endpoints rather than NAT.
• Review regional placement: a service in one region calling an API in another pays inter-region rates on every call.

Finding it in the bill

Because transfer lines seldom map to one resource, look for them by usage type in the provider’s billing data: Cost Explorer or the Cost and Usage Report on AWS, the BigQuery billing export on Google Cloud, and Cost Management on Azure. Flow logs are the way to connect a transfer charge back to the talking pair of resources.

In ZopNight

When billing sync is connected, ZopNight keeps line items that match no discovered resource, including networking and data-transfer charges, as unattributed spend, so org totals still reconcile to the invoice. Inter-region transfer is not priced as its own recommendation today, and ZopNight does not analyse VPC Flow Log records, so egress-by-destination analysis is not available yet. Idle NAT gateways are covered by the idle category.

Related: what keeps billing when idle, cloud migration costs, and storage tiering.