← All articles

Advanced Cloud Cost Optimization Strategy Teams Overlook

Why data‑transfer costs hide in plain sight

Most engineers focus on compute and storage when they trim a cloud bill. The line items for Data Transfer, Inter‑Region Traffic, and Cross‑AZ traffic often appear as a small percentage in Cost Explorer, yet they can add up to hundreds of dollars per month for a busy workload. Because these charges are incurred automatically—every time a service talks across a VPC, AZ, or region—teams rarely notice them until the bill spikes.

This post explains a concrete, under‑utilized strategy: consolidate and route traffic through VPC Endpoints, PrivateLink, and edge services to eliminate unnecessary data‑transfer fees. The steps include discovery, redesign, automation, and verification, all with copy‑pasteable AWS CLI commands.

Identify high‑cost inter‑region traffic

Before you can fix anything you need to know where the money is leaking.

Use Cost Explorer to surface data‑transfer spend

1. Open the AWS console → Billing → Cost Explorer.
2. Choose Usage Type as the group‑by dimension.
3. Filter on DataTransfer- prefixes (e.g., DataTransfer-Regional-Bytes, DataTransfer-Out-Bytes).
4. Set the time range to the last 30 days to capture recent patterns.

Pull granular data with the CLI

aws ce get-cost-and-usage \
  --time-period Start=$(date -d '-30 days' +%Y-%m-%d),End=$(date -d 'today' +%Y-%m-%d) \
  --granularity DAILY \
  --metrics UsageQuantity \
  --group-by Type=DIMENSION,Key=USAGE_TYPE \
  --filter '{"Dimensions":{"Key":"USAGE_TYPE","Values":["DataTransfer-Regional-Bytes","DataTransfer-Out-Bytes"]}}' \
  --output json > data-transfer.json

The resulting JSON lists daily bytes transferred per usage type. Convert bytes to GB (bytes/1024/1024/1024) and multiply by the current AWS rate (check the Data Transfer Pricing page) to see the dollar impact.

Spot the hot services

Cross‑reference the usage data with CloudTrail logs to map the traffic to services. For example, if DataTransfer-Regional-Bytes spikes when your ECS tasks call S3 in another region, you have a candidate for optimization.

Consolidate traffic with VPC Endpoints and PrivateLink

VPC Endpoints let you keep traffic inside the AWS network instead of routing over the public internet. This eliminates the Internet Data Transfer charge and often reduces inter‑AZ fees.

Create an Interface VPC Endpoint for S3

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc123def456ghi \
  --service-name com.amazonaws.us-east-1.s3 \
  --subnet-ids subnet-111aaa222bbb333cc subnet-444ddd555eee666ff \
  --security-group-ids sg-0123abcd4567efgh \
  --private-dns-enabled

• The endpoint creates ENIs in the selected subnets; traffic from any resource in those subnets to S3 stays within the VPC.
• Enable Private DNS so the standard s3.amazonaws.com hostname resolves to the endpoint automatically.

Use PrivateLink for custom services

If you run a microservice that other accounts consume, expose it via AWS PrivateLink. This removes the need for a public load balancer and avoids NAT/Internet egress.

aws ec2 create-vpc-endpoint-service-configuration \
  --network-load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/my-nlb/abcdef1234567890 \
  --acceptance-required

Share the generated Service ID with partner accounts; they create an Interface Endpoint pointing to it. All traffic travels over the AWS backbone.

Update IAM policies to force endpoint usage

Add a condition to the bucket policy or API permissions that denies requests without the aws:SourceVpce condition key.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"],
    "Condition": {
      "StringNotEquals": {"aws:SourceVpce": "vpce-0a1b2c3d4e5f6g7h8"}
    }
  }]
}

Now any request that bypasses the endpoint is rejected, guaranteeing cost‑saving traffic paths.

Use CloudFront and S3 Transfer Acceleration wisely

Edge services can offload traffic from your VPC, but they also introduce new pricing tiers. The rule of thumb: * CloudFront is ideal when you serve static assets to end‑users worldwide. It replaces many Data Transfer Out charges with a per‑GB edge price that is usually lower. * S3 Transfer Acceleration helps when you have large, cross‑continent uploads (e.g., media ingest). It uses the AWS global network to speed up transfers, but you pay a premium per GB.

When to enable CloudFront

1. Create a distribution that points to your S3 bucket or ALB.
2. In the Behaviors tab, set Cache Based on Selected Request Headers to Whitelist only the headers you need; extra headers cause cache misses and extra origin fetches.
3. Enable Origin Shield for a single region to reduce origin load and further cut data‑transfer from the origin.

Example CLI to create a CloudFront distribution for an S3 bucket

aws cloudfront create-distribution \
  --origin-domain-name my-bucket.s3.amazonaws.com \
  --default-root-object index.html \
  --enabled

After the distribution is live, update your DNS (Route 53) to point the domain to the CloudFront Domain Name. All client downloads now incur CloudFront egress rates, not S3 regional rates.

Leverage Direct Connect and Transit Gateway for predictable egress

When you have a steady stream of data moving between on‑premises data centers and AWS, AWS Direct Connect offers a flat‑rate, high‑throughput link that bypasses the public internet pricing.

If your organization already pays for Direct Connect, route all inter‑region replication through a Transit Gateway attached to the Direct Connect gateway. This moves the traffic off the public internet and applies the lower Direct Connect rate.

CLI to attach a VPC to a Transit Gateway

aws ec2 create-transit-gateway-vpc-attachment \
  --transit-gateway-id tgw-0a1b2c3d4e5f6g7h8 \
  --vpc-id vpc-0abc123def456ghi \
  --subnet-ids subnet-111aaa222bbb333cc

After attachment, update your route tables to point inter‑VPC CIDR blocks to the Transit Gateway. Verify the flow with VPC Flow Logs to ensure traffic no longer traverses the internet gateway.

Automate cleanup of unused endpoints and gateway attachments

Even after you implement the above, stale resources can creep back in. A lightweight Lambda function scheduled daily can prune anything that has not seen traffic for 30 days.

Sample Lambda (Python) that deletes idle Interface Endpoints

import boto3, datetime
ec2 = boto3.client('ec2')
cloudwatch = boto3.client('cloudwatch')

THRESHOLD_DAYS = 30
now = datetime.datetime.utcnow()

def lambda_handler(event, context):
    eps = ec2.describe_vpc_endpoints()['VpcEndpoints']
    for ep in eps:
        if ep['State'] != 'available':
            continue
        metric = cloudwatch.get_metric_statistics(
            Namespace='AWS/EC2',
            MetricName='NetworkPacketsOut',
            Dimensions=[{'Name':'VpcEndpointId','Value':ep['VpcEndpointId']}],
            StartTime=now - datetime.timedelta(days=THRESHOLD_DAYS),
            EndTime=now,
            Period=86400,
            Statistics=['Sum']
        )
        total = sum(dp['Sum'] for dp in metric['Datapoints'])
        if total == 0:
            print(f"Deleting idle endpoint {ep['VpcEndpointId']}")
            ec2.delete_vpc_endpoints(VpcEndpointIds=[ep['VpcEndpointId']])

Deploy the function, give it ec2:DescribeVpcEndpoints, ec2:DeleteVpcEndpoints, and cloudwatch:GetMetricStatistics permissions, and schedule it with an EventBridge rule (rate(1 day)).

Comparison table of common data‑transfer optimization options

Frequently asked questions

How can I tell if an Interface Endpoint is actually being used?

Enable VPC Flow Logs for the subnet that hosts the endpoint ENIs and filter on srcaddr or dstaddr equal to the endpoint's private IP. If the log shows zero packets over a 30‑day window, the endpoint is idle and can be removed.

Does using CloudFront completely eliminate S3 data‑transfer charges?

No. CloudFront still incurs origin fetch charges when a cache miss occurs. However, the majority of client‑side egress is billed at the CloudFront rate, which is typically lower than the S3 regional egress rate.

Will PrivateLink affect latency for internal microservices?

PrivateLink routes traffic over the AWS backbone, which is usually lower latency than traversing a NAT gateway or internet gateway. The added ENI hop adds a few microseconds, negligible for most workloads.

Is Direct Connect cost‑effective for a small team that only transfers a few terabytes per month?

Usually not. Direct Connect has a fixed port fee that can outweigh the per‑GB savings unless you consistently exceed the break‑even point (roughly 5‑10 TB/month depending on region). Use the Cost Explorer calculator to compare.

Key takeaways

• Data‑transfer fees are often hidden but can be a sizable portion of the bill.
• Use Cost Explorer and the aws ce CLI to pinpoint the services and regions that generate the most traffic.
• Replace public internet paths with Interface VPC Endpoints and PrivateLink to keep traffic on the AWS network and avoid egress charges.
• Deploy CloudFront for global client delivery and S3 Transfer Acceleration only for large, latency‑sensitive uploads.
• For steady, high‑volume pipelines, consider Direct Connect paired with a Transit Gateway to lock in a flat rate.
• Automate the removal of idle endpoints and gateway attachments with a scheduled Lambda to prevent waste from creeping back.
• The free AWS waste finder tool can give you a quick snapshot of idle resources, and creating a free account lets you start tracking savings immediately.

CloudBudgetMaster automates the discovery of idle and wasted AWS resources by scanning your account in read‑only mode today, quantifying the dollar impact of each item, and delivering actionable reports. Support for GCP, Azure, and Snowflake is coming soon.