sdlc.dev

AWS fundamentals path · Running it · Topic 17 of 18

Cost basics: where the bill comes from

Not started

On AWS you pay for what you provision and for what you move. Instance and database prices are easy to compare, so teams compare them, but the surprises on a bill usually come from elsewhere: **data transfer**, **NAT gateway processing**, **resources left running**, and **telemetry** nobody set limits on. Most of these are decided when you draw the architecture, not when you pick instance sizes.

Why it matters: AWS bills are rarely dominated by the instance prices people compare. Data transfer, NAT processing, idle resources and logs are where surprises come from, and they are architecture decisions.

  1. 1Moving data costs money

    Inbound from the internet is free; outbound to the internet, between Regions and between Availability Zones is billed per GB.

  2. 2NAT gateways charge twice

    Each NAT gateway is billed per hour and per GB it processes, on top of normal transfer. Heavy traffic through NAT adds up fast.

  3. 3Idle is not free

    Unattached EBS volumes, old snapshots, idle load balancers, unused public IPv4 addresses and forgotten test stacks all bill by the hour or month.

  4. 4Make cost visible

    Tag resources by team and service, turn on budgets with alerts, and look at Cost Explorer by usage type, not just by service.

1

How it works

The explanation, with examples you can run.

Data transfer

TrafficBilled?
From the internet into AWSNo
From AWS out to the internetYes, per GB (a monthly free allowance applies)
Between Availability Zones in a RegionYes, per GB in each direction
Between RegionsYes, per GB
Within one zone over private IPsGenerally no
To S3 or DynamoDB through a gateway endpointNo endpoint charge

Consequences: a multi-zone design pays for its replication and cross-zone calls (usually worth it, but measure it); serving large downloads straight from S3 or EC2 to the internet costs more than through CloudFront in many cases; and moving data between Regions for analytics can cost more than the analytics.

NAT gateways

A NAT gateway is billed for each hour it exists and each gigabyte it processes, and the traffic then pays normal transfer too. Typical offenders: pulling container images, calling S3 or DynamoDB without endpoints, and sending logs or metrics to AWS APIs from private subnets. Fixes are gateway endpoints for S3 and DynamoDB (free), interface endpoints for heavily used services, image caching, and checking the NAT gateway's BytesOutToDestination metric to see who is talking.

Things that bill while idle

  • Public IPv4 addresses: AWS charges per hour for every public IPv4 address, whether attached to an instance, a load balancer, a NAT gateway or sitting unused as an Elastic IP.
  • EBS volumes and snapshots left behind after instances are terminated, and snapshots kept forever.
  • Load balancers, NAT gateways and interface endpoints in environments nobody uses.
  • Over-provisioned capacity: instances at 5 % CPU, provisioned DynamoDB tables or RDS instances sized for a launch that never came.
  • CloudWatch Logs with no retention, and high-cardinality custom metrics.
  • S3 incomplete multipart uploads and old object versions without lifecycle rules.

Making cost an engineering signal

  1. Tag everything with owner, service and environment, and activate those tags as cost allocation tags.
  2. Create AWS Budgets with alerts at, say, 80 % and 100 % of the expected monthly spend, per account or per tag. Turn on Cost Anomaly Detection.
  3. Read Cost Explorer grouped by usage type: DataTransfer-Regional-Bytes, NatGateway-Bytes and PublicIPv4 lines tell you more than "EC2-Other".
  4. Commit to steady baselines with Savings Plans, use Spot for interruptible work, and pick Graviton (Arm) instances where your software supports it.
  5. Delete what is idle, and give test environments a schedule or an expiry date. Infrastructure as code makes that safe: what was created by a pipeline can be destroyed by one.
2

Check yourself

3 questions. Get them all right to finish this topic.

  1. 1.Two services in the same Region talk heavily to each other, one in zone a and one in zone b. Which charge appears?
  2. 2.Private ECS tasks pull large images from ECR and read from S3 through a NAT gateway. What cuts the cost most?
  3. 3.Which of these is billed even when nothing uses it?

0 of 3 right so far. Get all three to finish this topic.

Go deeper