In this guide 6 sections
Data transfer grows because traffic grows and because architecture sends it the long way. The usual causes are internet egress, traffic between zones, NAT gateway processing and content served without a cache. Find the sending service with flow logs and the usage type on the bill.
Know the four kinds of transfer charge
Providers bill data leaving their network, data crossing zones or regions, and data passing through certain gateways. Data coming in is usually free. That is why the bill surprises people.
Internet egress is traffic to your users, partners and downloads. Inter-zone traffic is chatter between servers in different availability zones. Inter-region traffic covers replication and backups sent abroad. NAT gateway charges apply per gigabyte processed, on top of the hourly fee.
Each has its own usage type on the invoice. The bill already tells you which one is rising.
- Internet egress to users
- Cross-zone traffic inside one region
- Cross-region replication
- NAT gateway processing
Check what your NAT gateway is carrying
A NAT gateway lets private servers reach the internet. It also carries traffic that never needed to leave: calls to S3, DynamoDB, container registries and update mirrors.
A gateway endpoint for S3 or DynamoDB is free to run on AWS and removes that traffic from the NAT path. Interface endpoints cost an hourly fee but often beat per gigabyte processing for busy services.
Container clusters are frequent offenders. Pulling large images on every node start can move terabytes through the gateway.
Look for content served without a cache
Images, videos, installers and API responses served straight from a bucket or an application server are billed as egress every time. A content delivery network can serve repeat requests from its edge.
Check cache headers. A missing Cache-Control line, or a query string that varies on every request, makes the CDN fetch the file again. Hit ratio in the CDN report is the number to read.
Compress responses. Resize images before they leave. Smaller files cost less on every request.
Find which service is sending the data
Start with the bill. Filter the usage type for data transfer, then group by service and linked account. That narrows the field before any tool is switched on.
Then turn on VPC flow logs or the equivalent for the suspect subnet. Query the logs for the top source and destination pairs by bytes. On Azure and Google Cloud, network watcher and flow logs do the same job.
Match the top talker to an owner. A backup job, a log shipper, a data export to a partner or a chatty microservice usually appears quickly.
- Top source and destination by bytes
- Time of day the spike begins
- Whether the traffic leaves the region
- Which team deployed the sender
Fix the path before you negotiate the price
Keep chatty services in the same zone where resilience allows. Move a reporting job next to its database. Batch small calls into fewer large ones. Replicate only what a recovery plan needs.
Set an alert on the transfer usage type so a new spike reaches you within a day. A budget filtered to data transfer is enough to begin.
Next step: filter last month’s bill to data transfer, name the top service, and ask its owner what it sends and where.
Data transfer investigation sheet
A single-page investigation sheet with a row per traffic path. Columns record usage type from the bill, source service, destination, bytes per month, suspected cause, owner, proposed fix and date checked. A top block lists NAT gateways, CDNs and replication jobs in the account.
Open a blank worksheet to printQuestions owners ask
Is inbound data really free?
On the major providers, data coming into the network is generally free. Charges apply to data leaving, crossing zones or regions, or passing through gateways.
Why did the NAT gateway line jump?
Usually a new workload pulling images, packages or storage data through it. Check which subnet the traffic comes from and add endpoints for provider services.
Will a CDN always reduce transfer cost?
Only with good cache settings. A CDN with a low hit ratio still fetches from your origin repeatedly and can add its own charges.
How do I find the biggest sender quickly?
Filter the bill to data transfer by service, then use flow logs on the suspect subnet to list the top source and destination pairs by bytes.