AWS gives you two ways to connect a network to the cloud, and on cost they trade places at a volume threshold. AWS Site-to-Site VPN costs about $0.05 per hour per connection with no upfront commitment, but data transfer out runs at the standard internet rate near $0.09 per gigabyte, so it is cheapest for low or variable traffic. AWS Direct Connect adds a fixed port-hour fee, roughly $0.30 per hour for a 1 Gbps port, but its data transfer out is far lower, often a few cents per gigabyte, so it is cheapest for high, steady volume. The decision is data volume: low and bursty favors VPN, high and continuous favors Direct Connect. Getting this right is part of our 31% average bill reduction.
Last updated: June 2026 · Written by Fredrik Filipsson and reviewed by Morten Andersen · See, Cut, Lock, Run method
AWS Direct Connect and AWS Site-to-Site VPN solve the same problem, connecting an on-premises network or data center to AWS, but they bill on different axes. A VPN runs over the public internet and charges a small hourly connection fee plus standard data transfer. Direct Connect provisions a dedicated physical link and charges for the port by the hour plus a much lower data transfer rate. Which is cheaper is not a fixed answer; it depends on how much data crosses the link. This comparison is part of our complete guide to AWS cost optimization, the cluster pillar it links up to.
What is the cost difference between Direct Connect and VPN?
The cost difference is that VPN charges a small hourly fee and internet-rate data transfer, while Direct Connect charges a fixed port-hour fee and a much lower data transfer rate. AWS Site-to-Site VPN bills about $0.05 per hour per connection plus standard data transfer out, which for internet egress is around $0.09 per gigabyte after the free tier, per the AWS VPN pricing page. AWS Direct Connect bills port hours by speed, roughly $0.30 per hour for a 1 Gbps dedicated port, plus data transfer out at reduced rates that typically run from about $0.02 to $0.06 per gigabyte depending on the Region and Direct Connect location, per the AWS Direct Connect pricing page. So VPN is cheaper at the start and on the meter when traffic is light, and Direct Connect is cheaper per gigabyte once you are moving enough data for the lower transfer rate to outweigh the fixed port cost. Verify current rates for your Region and port speed before modeling, since both schedules change.
| Criterion | Site-to-Site VPN | Direct Connect |
|---|---|---|
| Connection fee | About $0.05 per hour per connection | Port hours, about $0.30/hr for 1 Gbps |
| Data transfer out | Internet rate, near $0.09 per GB | Reduced, roughly $0.02 to $0.06 per GB |
| Upfront cost | None | Cross-connect setup and port provisioning |
| Idle cost | Low hourly fee only | Full port hours even when quiet |
| Cheapest for | Low, variable, or new traffic | High, steady, predictable volume |
| Performance | Public internet, variable latency | Dedicated link, consistent latency |
The verdict: start on a VPN, because it is cheap, fast to stand up, and carries no port commitment, then move to Direct Connect once steady data transfer volume is high enough that the lower per-gigabyte rate covers the port-hour cost. Many hybrid estates run both, using Direct Connect for the bulk steady flow and a VPN as backup or for low-volume sites.
When is a VPN the cheaper choice?
A VPN is cheaper when traffic is low, variable, or just starting, because there is no port to pay for during the quiet hours. The only fixed cost is the small per-hour connection fee, so a site that moves modest or bursty volumes never pays for capacity it does not use. It is also the right default for a new connection whose long-term volume you cannot yet predict, because committing to a Direct Connect port before you know the traffic risks paying port hours that the data transfer savings never recoup. The catch is the data transfer rate: every gigabyte out runs at the standard internet rate near $0.09, so a VPN that quietly grows into a high-volume link can become more expensive than a Direct Connect port would have been. The discipline is to watch the transfer volume and revisit the choice as it rises. This is the same volume-versus-commitment logic in our sibling guide on AWS WAF and Shield cost optimization, where a fixed subscription only pays off above a usage threshold.
When does Direct Connect win on cost?
Direct Connect wins when data transfer volume is high and steady enough that the reduced per-gigabyte rate saves more than the fixed port hours cost. Because the data transfer out rate on Direct Connect is a fraction of the internet rate, every gigabyte that crosses the dedicated link instead of the VPN saves several cents, and at large continuous volumes those cents add up faster than the port-hour fee accrues. The break-even is a simple comparison: estimate monthly gigabytes out, multiply by the rate difference between internet egress and the Direct Connect rate for your Region, and check whether that monthly saving exceeds the port-hour cost for the month. Above the threshold, Direct Connect is cheaper and also delivers consistent latency; below it, the port sits underused and a VPN would cost less. For workloads pushing large steady volumes off AWS, this often pairs with the broader egress reduction work in how to reduce cross-cloud egress costs in a multicloud setup, and it routes to the same fix in our AWS cost optimization service.
Paying internet rates on data that should be on a dedicated link?
Our AWS cost audit models your hybrid transfer volume, finds the VPN-versus-Direct-Connect break-even, and proves the network saving against a clean baseline before anything is committed. On the performance model, you pay only from realized savings. No savings, no fee.
Book a cloud cost audit →The AWS Cost Optimization Field Guide includes the network cost model we use to choose between Direct Connect and VPN and to size the port to real volume.
Frequently asked questions
Is AWS Direct Connect cheaper than VPN?
It depends on data volume. AWS Site-to-Site VPN is cheaper to start at about $0.05 per hour per connection but carries standard internet-rate data transfer out near $0.09 per gigabyte. Direct Connect adds port-hour fees but its data transfer out is much lower, often a few cents per gigabyte, so it wins at high, steady volume.
How much does AWS Site-to-Site VPN cost?
AWS Site-to-Site VPN costs about $0.05 per hour for each VPN connection, plus standard AWS data transfer out charges on the data that flows over it. There is no upfront cost, which makes it cheap to start and well suited to low or variable traffic.
How is AWS Direct Connect priced?
Direct Connect is priced on port hours by port speed, for example roughly $0.30 per hour for a 1 Gbps dedicated port, plus data transfer out at reduced per-gigabyte rates that depend on the Region and Direct Connect location. You pay for the port whether or not data flows.
When does Direct Connect become worth the cost?
Direct Connect becomes worth it when steady data transfer volume is high enough that the savings on per-gigabyte data transfer out exceed the fixed port-hour cost. For consistent, large hybrid traffic it usually wins; for low or bursty traffic a VPN is cheaper because there is no port to pay for.
The short version
Site-to-Site VPN is cheap to start, about $0.05 per hour with internet-rate data transfer, so it wins on low or variable traffic. Direct Connect adds a fixed port-hour fee but cuts the per-gigabyte transfer rate, so it wins on high, steady volume. Start on a VPN, model the break-even as volume grows, and move to Direct Connect once the transfer savings cover the port. When you want the break-even modeled and the saving proven down, that is part of what our AWS cost optimization service delivers.
Cloud pricing and service behavior change frequently. Verify the specifics in this guide against the providers’ own current documentation and the FinOps Foundation: AWS pricing ↗, AWS documentation ↗ and FinOps Foundation Framework ↗. This article also reflects Cloud Cost Room’s hands-on, vendor-neutral engagement experience.