On an AWS bill, which network traffic is free and which shows up as a data-transfer charge? Cover traffic between two instances in one Availability Zone, traffic between Availability Zones in the same Region, and traffic out to the internet.

## The three questions that decide every network charge AWS network billing looks arbitrary until you realise it answers three questions in order: 1. **Does the traffic leave the AWS network?** If it goes to the public internet, it is egress and it is billed per GB. 2. **Does it cross an Availability Zone boundary?** Inside a Region, the AZ boundary is a billing boundary. 3. **What address did it use?** Traffic sent to a public or Elastic IPv4 address is treated as leaving the VPC, even when the two endpoints are physically adjacent. Everything below is those three rules applied. ## Inbound is free, outbound is not Data transferred *into* AWS from the internet carries no charge. This asymmetry is deliberate and it shapes cost profiles: an ingest-heavy workload (log collection, uploads, backups landing in S3) has almost no network bill, while a delivery-heavy workload (video, images, large API responses, database exports pulled to an office) can have a network bill larger than its compute bill. Outbound to the internet is tiered — the per-GB rate steps down as monthly volume grows — and AWS includes a modest free allowance per month per account, aggregated across services and Regions. As of 2025 that allowance is 100 GB/month, which is meaningful for a hobby project and rounding error for production. Check current pricing rather than quoting a rate from memory; the *shape* is what you are expected to know. ## The AZ boundary is a billing boundary Within one Region: - Same AZ, private IPv4 addresses: **free**. - Different AZs: **charged per GB, in each direction**. That second point is the one candidates miss. Cross-AZ transfer is metered on the sending side *and* the receiving side, so moving 1 TB between AZs produces 2 TB of billed transfer. In most commercial Regions the rate is on the order of a cent per GB each way — small enough to ignore per request, large enough to dominate a bill when a service mesh, a replicating database, or a chatty internal RPC path runs across AZs all day. This is why cross-AZ transfer is such a common surprise: nobody provisions it, nobody sees it in a resource inventory, and it grows with traffic rather than with fleet size. ## Private versus public addressing Distance is not the only variable. Traffic sent to a **public IPv4 or Elastic IP address** is charged per GB in each direction even when both endpoints are in the same AZ, because the packets are routed out through the VPC's internet edge rather than staying on the private path. Two very common ways to trip this: - Hardcoding a public DNS name or public IP for an internal dependency, instead of the private DNS name that resolves to a private address inside the VPC. - Reaching an in-Region AWS service endpoint from a private subnet through a NAT Gateway rather than through a VPC endpoint — you then pay the NAT's own data-processing charge on top. The fix in both cases is to keep the flow on private addressing. ## Cross-Region and edge Traffic between Regions is charged per GB at a higher rate than cross-AZ and is billed on the source side. Cross-Region replication, multi-Region active-active designs, and "just read from the other Region" fallbacks all buy resilience with a recurring transfer bill; that is a legitimate trade, but it should be a decision rather than an accident. Content delivery changes the arithmetic for internet-facing traffic: data transferred from an AWS origin to Amazon CloudFront is not charged, and you pay CloudFront's own (usually lower at volume) egress rates plus request charges instead. The cache hit ratio then decides how much origin traffic you avoid entirely. ## Finding the flows The bill tells you the total; it does not tell you *which* flow produced it. VPC Flow Logs do. A flow log record carries `bytes` alongside `srcaddr`/`dstaddr`, and the `az-id` field lets you attribute volume to an AZ. Aggregating bytes by source/destination pair over a day usually finds the offender in one query — most often a replication stream, a log shipper, a cache miss path, or a load balancer spreading traffic across zones. ``` # conceptual shape of the aggregation you want SUM(bytes) GROUP BY srcaddr, dstaddr, az-id ORDER BY SUM(bytes) DESC ``` ## Why this matters in an interview Data transfer is the line item that is invisible in every architecture diagram. An engineer who can say "this design puts a gigabyte per second across an AZ boundary and that is billed twice" is doing capacity planning; one who assumes "it's all inside the VPC so it's free" will ship it and find out at the end of the month.