Amazon VPC Pricing: The VPC Is Free — Everything Around It Bills

Amazon VPC has the longest list of free-to-create resources of any AWS service — the VPC itself, subnets, route tables, security groups, NACLs, internet gateways, virtual private gateways, all free. The bill comes from what you attach to those resources: public IPv4 addresses (every one of them billable since February 2024), Interface VPC Endpoints per AZ, NAT Gateways, Transit Gateways, VPN connections, Direct Connect, VPC Lattice service networks, and the easily-overlooked $0.01/GB each way for inter-AZ data transfer on every byte that crosses AZ boundaries.

Amazon VPC pricing includes NAT Gateway hours and data processing, VPC endpoints, Transit Gateway attachments, peering data transfer, and public IPv4 addresses. In us-east-1 (June 2026), public IPv4 addresses bill $0.005/hour since February 2024. Most surprises come from NAT Gateway processing fees and interface endpoints left running in unused AZs.

This post is the bill story. For the operational angle — VPC design, subnet layout, security group hygiene, multi-account network architecture — see our VPC networking best practices guide. NAT Gateway pricing (one of the most consequential VPC-related lines) has its own dedicated post at NAT Gateway billing.

The 10 VPC-Adjacent Billing Dimensions

If you only audit one dimension first, map NAT Gateway GB processed — Gateway endpoints for S3/DynamoDB often eliminate most NAT egress.

The IPv4 Address Charge: The Bill Change That Surprised Everyone

In February 2024, AWS introduced a charge for every public IPv4 address in use. Before the change, public IPv4 was free as long as it was attached to a running resource. After: every public IP, attached or not, bills $0.005/hour ($3.60/month per address).

The fleet-wide impact on accounts that have not audited:

• Every public-facing EC2 instance with an Elastic IP: $3.60/month each.
• Every NAT Gateway: $3.60/month for its public IP, on top of the NAT Gateway charges themselves.
• Every public-facing Application Load Balancer: an IP per AZ × $3.60/month.
• Every old Elastic IP attached to terminated instances: $3.60/month, forever, until released.

A medium-sized organization with ~100 public-facing endpoints saw the line item appear from zero to $360/month overnight in February 2024 with no warning beyond the AWS announcement.

Gateway Endpoints Are Free — Use Them

VPC Gateway Endpoints for S3 and DynamoDB are completely free — no hourly charge, no per-GB processing. They route traffic between resources in your VPC and the service without going through a NAT Gateway or the public internet.

The economic impact: a workload that accesses 1 TB/month of S3 via a NAT Gateway pays ~$45 in NAT data processing fees. The same workload with an S3 Gateway Endpoint pays $0. Every VPC with workloads that access S3 or DynamoDB should have Gateway Endpoints for both. The configuration is one-time, free, non-controversial.

Interface Endpoints: The Hidden Per-AZ Multiplier

Interface VPC Endpoints (PrivateLink) cost $0.01/hour per endpoint per AZ plus $0.01/GB of data processed. A workload using 10 AWS services privately (Secrets Manager, SQS, SNS, ECR API, ECR Docker, KMS, CloudWatch Logs, etc.) across a 3-AZ deployment costs $216/month just for the endpoint hours before data.

The decision is per-service: when does the Interface Endpoint pay off vs routing the same traffic via NAT Gateway?

The decision is service-by-service. Most VPCs benefit from Interface Endpoints for high-volume services (CloudWatch Logs, ECR, S3 via Interface if Gateway is not enough) and stay on NAT for low-volume services (KMS, IAM, Secrets Manager at small volume).

Inter-AZ Data Transfer: The Quietest Bill Driver

Inter-AZ data transfer bills $0.01/GB in each direction — both the sender and receiver pay. A microservices architecture with 3-AZ EKS clusters routinely sees 1–10 TB/month of inter-AZ traffic as services in one AZ call services in another. The bill is not large on a per-GB basis, but it compounds across services and is largely invisible without explicit measurement.

Mitigations:

• EKS Topology Aware Hints route Kubernetes service traffic to same-AZ pods preferentially. Enabled at the service level.
• Topology spread constraints ensure replicas of the same service spread across AZs so callers in any AZ have a local replica.
• AWS Local Zones for latency-sensitive single-AZ workloads where the multi-AZ overhead is not justified.
• Cluster-aware service discovery (Consul, custom DNS) that prefers local-AZ endpoints.

For chatty service pairs (a frontend and its backend, for example), explicit single-AZ placement is often the cheapest answer at the cost of losing the multi-AZ redundancy on that specific service pair.

VPC Peering vs Transit Gateway: The 5–10 VPC Crossover

VPC Peering is free for the connection itself; data transfer bills the standard $0.01/GB inter-AZ rate (or $0.02/GB inter-region for cross-region peering). Transit Gateway charges $0.05/hour per VPC attachment ($36/month per VPC) plus $0.02/GB processed through the TGW.

For 2–3 VPCs needing point-to-point connectivity, peering is cheaper and operationally simpler — the cost is purely data transfer at standard rates. For 5+ VPCs needing full-mesh connectivity, peering’s n² connection complexity becomes operationally untenable; Transit Gateway’s hub-and-spoke model simplifies management at the cost of per-VPC attachment fees.

The crossover is roughly 5–10 VPCs depending on traffic patterns. Below: stay on peering. Above: Transit Gateway’s operational simplicity is worth the per-attachment cost.

VPC Lattice: The Modern Service Mesh

VPC Lattice is AWS’s managed service-mesh primitive — service network at $0.025/hour, services at $0.025/hour each, $0.025/GB processed. A 50-service workload on Lattice costs roughly $900/month for the service and network charges, plus data processing.

The comparison vs running Istio on EKS:

• Istio: no per-service AWS charge, but adds control-plane operational overhead (Istio mesh management, configuration drift, sidecar resource overhead on every pod, certificate management).
• Lattice: per-service AWS charge, but zero operational overhead — service discovery, auth, observability are managed.

The right choice depends on team capacity. Teams with strong service-mesh operational expertise can run Istio at scale; teams without that capacity will find Lattice’s managed model worth the per-service rate.

When to Use Each VPC Connectivity Pattern

A 30-Day VPC Bill Cleanup Plan

Week 1 — IPv4 audit. Find every public IPv4 address in the account: aws ec2 describe-addresses for EIPs, aws ec2 describe-instances --filters Name=ip-address for instance public IPs. Release unattached EIPs immediately. Consolidate public-facing endpoints behind ALB/NLB where multiple instances currently have their own public IPs.

Week 2 — Add Gateway Endpoints. Audit every VPC for the presence of S3 and DynamoDB Gateway Endpoints. Add to every VPC that doesn’t have them. The change is non-destructive and immediately reduces NAT processing fees for S3/DynamoDB traffic.

Week 3 — Interface Endpoint break-even. For each Interface Endpoint currently provisioned, check actual data processed (CloudWatch metric BytesProcessed per endpoint). If under ~620 GB/month per AZ, consider removing and routing through NAT. Conversely, for high-volume services currently routing through NAT, consider adding an Interface Endpoint.

Week 4 — Inter-AZ topology. For EKS workloads, audit Topology Aware Hints adoption. For chatty service pairs, evaluate explicit single-AZ placement vs the multi-AZ redundancy trade-off. Use VPC Flow Logs to identify the highest-volume inter-AZ traffic patterns.

More in This Series

Part of the AWS Service Pricing series (June 2026).

• Previous: Part 10
• Next: Part 12
• Browse all: Cost Optimization & FinOps category

What This Post Doesn’t Cover

• NAT Gateway pricing details and alternatives (fck-nat, VPC endpoints, NAT instances) — covered in the dedicated NAT Gateway billing post.
• Cross-region data transfer rates for specific service pairs — covered in the data transfer costs post.
• Direct Connect pricing in depth including hosted vs dedicated and LAG configurations — covered in our hybrid connectivity content.
• VPC Flow Logs cost optimization patterns (S3 vs CloudWatch vs Firehose destinations) — covered in our observability content.

If You Only Do One Thing This Week

Add S3 and DynamoDB Gateway Endpoints to every VPC in your account that doesn’t have them. The change is one IaC line or one CLI command per VPC, costs nothing, and immediately starts saving on NAT Gateway data processing fees for S3 and DynamoDB traffic. Cross-check the NAT Gateway impact in our NAT Gateway billing post — the two changes (Gateway Endpoints + a NAT audit) typically compound to recover 20–40% of the networking-related bill on accounts that haven’t done either recently.

For the broader networking architecture decisions — multi-account network setup, Transit Gateway design, hybrid connectivity — the VPC networking best practices guide covers the design side.

Frequently asked questions