The Same Byte, Billed Three Times

Ask what it costs to move a terabyte inside AWS and the honest answer is the one Corey Quinn gave in 2019: "Who the hell knows." He wrote it over a diagram that is still the best map of the problem. The values on it have moved since. The shape hasn't.

The shape is that data transfer is not a price. It is a lookup on which boundary the byte crossed, and there are more boundaries than the architecture diagram shows. Two instances in the same availability zone talking over private IPv4: free. The same two instances, in the same rack, talking over their public or Elastic IPs: charged as regional transfer, in both directions, because reaching an instance by its public address bills as regional traffic whatever zone it is sitting in. Across zones: charged, in both directions. Across regions: charged, at a rate depending on the pair. Out to the internet: tiered, while ingress stays free, because the meter only runs one way.

Then the multipliers arrive. Route private-subnet traffic through a NAT gateway and you pay an hourly charge for the gateway plus a per-gigabyte processing fee on everything passing through it, on top of whatever the transfer itself costs. Reach object storage that way and you are paying processing on traffic that never leaves AWS, which a gateway endpoint would have carried for nothing. Swap in an interface endpoint and you have traded that for per-hour charges in every zone, plus per-gigabyte on top.

Which is how one byte meters three times on a single trip. A user asks for a file. The service in zone A asks a service in zone B for it, and that service fetches the object through a NAT gateway, which charges for every gigabyte it processes. The bytes come back across the zone boundary, charged again in both directions. They leave for the user over the internet, charged a third time. Nobody designs that. It falls out of three decisions, each locally reasonable, compounding into a line item nobody owns.

Two things follow.

You cannot estimate this from the pricing page. The pricing page prices products. Your bill meters paths. The only reliable method is to read the usage types in the billing data and find which boundaries your traffic actually crosses, which are rarely the ones you'd predict from the diagram.

Check the numbers rather than trusting any blog post, this one included. AWS began charging for every public IPv4 address in 2024, and egress stopped being chargeable for customers leaving a provider at around the same time. The topology of the map is stable over years. The prices printed on it are not.

The instinct worth building is architectural rather than financial. Every zone boundary in your design is a line item. Every NAT gateway is a toll booth you installed and then forgot you were paying. Both may well be worth it — but the diagram doesn't mention either, and the invoice does.