Service guide
How to reduce AWS networking and data transfer costs
Nobody plans networking spend; it emerges. Traffic routes the way the first VPC diagram drew it, and the bill quietly charges per gigabyte at every hop — NAT processing, cross-AZ replication, per-address IPv4 fees and load balancers fronting nothing.
The free scan reads NAT metrics, endpoint configuration, public IP inventory and load balancer health across every region.
Run the free scanWhere networking money leaks
- →AWS traffic through NAT gateways. S3 downloads, ECR pulls and DynamoDB calls routed through NAT at $0.045/GB — traffic that free gateway endpoints (S3, DynamoDB) or cheap interface endpoints would carry. The single most common networking finding.
- →NAT redundancy in non-production. Three NAT gateways (~$100/month standing) for a dev VPC is resilience nobody asked for. One gateway — or none, with public subnets and tight security groups — is a defensible dev posture.
- →Cross-AZ chatter. $0.01–0.02/GB each way between availability zones adds up on chatty microservices, database replication and misrouted NAT paths. Subnets should route to same-AZ resources; services that talk constantly should co-locate.
- →Public IPv4 at $3.60 each. Since February 2024, every public IPv4 bills $0.005/hour — idle Elastic IPs, one-IP-per-instance patterns, per-AZ load balancer addresses. Accounts routinely carry 2–3x more public IPs than anyone remembers allocating.
- →Load balancers fronting nothing. An ALB costs ~$18/month before traffic; NLBs ~$16.50. Balancers with no healthy targets — left over from retired services — are pure standing charge, findable in one API call.
Put numbers on it
Frequently asked questions
Why is my data transfer bill so hard to attribute?
AWS reports transfer by category (inter-AZ, internet egress, NAT processing) rather than by application, so the bill tells you what kind of movement cost money but not who moved it. VPC Flow Logs sampled briefly, or per-service CloudWatch traffic metrics, connect the categories to culprits — our audit does this mapping as standard.
What is the quickest networking win?
Gateway VPC endpoints for S3 and DynamoDB: free to create, immediate effect on NAT processing charges, no downtime, no code changes. If your workloads pull from S3 through NAT gateways, this single change can cut the NAT line dramatically the same day.
£499 fixed. Free scan first. 20%+ found or it’s free.
The scan is read-only — a role you create and delete, no keys shared — and shows your estimated monthly saving before anyone talks about money.