To cut egress, move high-volume traffic off the public internet and onto private connectivity. Internet data transfer out starts around $0.09 per GB, while Direct Connect, VPC peering, and PrivateLink carry traffic on private paths at lower data transfer rates or avoid internet egress entirely. Map where your egress goes, route AWS and partner service traffic through VPC endpoints, peer VPCs instead of crossing the internet, adopt Direct Connect for steady on-premises transfer, and co-locate communicating services in the same region and Availability Zone. Removing egress waste is part of the 31% average bill reduction across the 500+ environments we have optimized.
Last updated: June 2026 · Written by Fredrik Filipsson and reviewed by Morten Andersen · See, Cut, Lock, Run method
Egress, or data transfer out, is the cost line that grows with traffic and hides in plain sight, because it is buried under per-GB rates that look trivial until you multiply them by terabytes. Private connectivity is the structural fix: when traffic stays on private paths instead of leaving through the public internet, it bills at a lower rate or not at all. This guide is part of our complete guide to cloud storage and data cost optimization, the cluster pillar it links up to, and it focuses on the connectivity choices that move egress spend.
How much does cloud egress cost?
Cloud egress to the public internet starts at about $0.09 per GB for the first tier on AWS and falls with volume, while inter-AZ and cross-region transfer carry their own per-GB charges. Per the AWS data transfer pricing, internet data transfer out is the most expensive path, traffic between Availability Zones in a region is around $0.01 per GB in each direction, and cross-region transfer sits between the two. Traffic over AWS Direct Connect is billed at a lower data transfer out rate than the internet, plus a port-hour fee, which is why steady, high-volume transfer is cheaper on a dedicated connection. The same pattern holds across clouds: internet egress is the premium path, and private connectivity is the discount. Verify current rates against each provider before modeling, since data transfer pricing changes and varies by region.
How do I cut egress cost step by step?
Cut egress by finding the largest flows and moving them onto private paths. Work through these steps:
- Map where your egress is going. Use cost and flow data to find the largest data transfer paths, since internet egress at around $0.09 per GB is the most expensive and the first target.
- Move service traffic onto VPC endpoints. Route traffic to AWS services and partner services through VPC endpoints and PrivateLink so it stays private instead of leaving through a NAT gateway to the internet.
- Use peering for VPC-to-VPC traffic. Connect VPCs with peering or Transit Gateway so cross-VPC traffic uses private paths rather than public IPs and internet egress.
- Adopt Direct Connect for steady on-premises transfer. Move large, steady on-premises or data-center traffic onto Direct Connect, where data transfer out bills at a lower rate than internet egress.
- Keep traffic in-region and in-AZ where possible. Co-locate communicating services in the same region and Availability Zone to avoid cross-region and inter-AZ transfer charges entirely.
This is the same waste-elimination work in our rightsizing and waste elimination service. The snapshot counterpart, where cross-region copies drive both storage and transfer, is covered in the sibling guide how to optimize snapshot lifecycle across clouds.
Traffic to an AWS service routed through a NAT gateway to the internet pays twice: the NAT data processing fee and internet egress. A VPC endpoint for that service keeps the traffic on the private network and removes both. On estates with chatty access to S3, DynamoDB, or partner APIs, replacing NAT-routed paths with endpoints is one of the cleanest egress savings available.
Which private connectivity option should I use?
Use VPC endpoints and PrivateLink for service traffic, VPC peering or Transit Gateway for VPC-to-VPC traffic, and Direct Connect for steady on-premises transfer. Each addresses a different path, and the right choice depends on what is talking to what. PrivateLink exposes a single service through an endpoint and bills an hourly endpoint fee plus data processing, which suits keeping access to one service private. VPC peering connects whole VPCs and you pay data transfer across the connection, which suits broad cross-VPC communication. Direct Connect is a dedicated physical link to AWS that bills a port-hour fee plus a reduced data transfer rate, which pays off when on-premises or colocation traffic is large and continuous. The table compares the cost shape of each.
| Option | Cost shape | Best for | Egress effect |
|---|---|---|---|
| VPC endpoint / PrivateLink | Hourly endpoint fee + data processing | Private access to one service | Removes NAT and internet egress |
| VPC peering | Data transfer across peering | Broad VPC-to-VPC traffic | Avoids public-IP egress |
| Transit Gateway | Attachment-hour + data processing | Many VPCs at scale | Central private routing |
| Direct Connect | Port-hour + reduced transfer rate | Steady on-premises transfer | Lower rate than internet egress |
Verdict: match the connectivity option to the traffic path, and reserve the public internet for traffic that genuinely must go there.
Where is your egress leaking through the public internet?
Our cost audit maps every data transfer path, moves the big flows onto private connectivity, and proves the saving against a clean baseline. On the performance model, you pay only from realized savings. No savings, no fee.
Book a cloud cost audit →The Cloud Storage and Egress Cost Playbook includes the connectivity decision tree we use to move traffic off the public internet.
Frequently asked questions
How much does cloud egress cost?
Internet data transfer out from AWS starts at about $0.09 per GB for the first tier and falls with volume, while inter-AZ traffic is around $0.01 per GB each direction and cross-region transfer is higher. Private connectivity over Direct Connect bills data transfer out at a lower rate than the public internet, which is why moving steady traffic onto it reduces cost.
Does private connectivity reduce egress charges?
Yes. Routing traffic over Direct Connect, VPC peering, or PrivateLink keeps it off the public internet, where egress is most expensive, and onto private paths billed at lower data transfer rates or no internet egress at all. The saving is largest on high, steady volumes that would otherwise leave through a NAT gateway to the internet.
What is the difference between VPC peering and PrivateLink for cost?
VPC peering connects whole VPCs and you pay data transfer across the peering connection, while PrivateLink exposes a specific service through an endpoint and you pay an hourly endpoint fee plus data processing. Peering suits broad VPC-to-VPC traffic; PrivateLink suits exposing one service privately without opening the whole network.
What is the biggest hidden egress cost?
NAT gateway data processing and inter-AZ traffic. Traffic to AWS services routed through a NAT gateway to the internet pays both the NAT processing fee and internet egress, when a VPC endpoint would keep it private, and chatty services split across Availability Zones pay inter-AZ charges in both directions.
The short version
Internet egress at around $0.09 per GB is the premium data transfer path, and private connectivity is the discount. Map your flows, route service traffic through VPC endpoints, peer VPCs, adopt Direct Connect for steady on-premises transfer, and keep communicating services in the same region and AZ. When you want every data transfer path mapped and the saving proven down, that is part of what our rightsizing and waste elimination service delivers.
Cloud pricing and service behavior change frequently. Verify the specifics in this guide against the providers’ own current documentation and the FinOps Foundation: FinOps Foundation Framework ↗ and FinOps Rate Optimization capability ↗. This article also reflects Cloud Cost Room’s hands-on, vendor-neutral engagement experience.