Understanding Data Transfer Costs: The Silent Budget Killer in AWS

# Free Gateway Endpoint for S3
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
 
  route_table_ids = [
    aws_route_table.private.id,
  ]
 
  tags = {
    Name = "s3-gateway-endpoint"
  }
}
 
# Free Gateway Endpoint for DynamoDB
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
 
  route_table_ids = [
    aws_route_table.private.id,
  ]
 
  tags = {
    Name = "dynamodb-gateway-endpoint"
  }
}
 
# Interface Endpoint for ECR (Docker registry)
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
 
  subnet_ids = [
    aws_subnet.private_a.id,
    aws_subnet.private_b.id,
  ]
 
  security_group_ids = [
    aws_security_group.vpc_endpoints.id,
  ]
 
  tags = {
    Name = "ecr-api-endpoint"
  }
}
 
# Interface Endpoint for Secrets Manager
resource "aws_vpc_endpoint" "secrets_manager" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.secretsmanager"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
 
  subnet_ids = [
    aws_subnet.private_a.id,
    aws_subnet.private_b.id,
  ]
 
  security_group_ids = [
    aws_security_group.vpc_endpoints.id,
  ]
 
  tags = {
    Name = "secrets-manager-endpoint"
  }
}
 
# Security group for VPC endpoints
resource "aws_security_group" "vpc_endpoints" {
  name_description = "Allow HTTPS to VPC endpoints"
  vpc_id           = aws_vpc.main.id
 
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [aws_vpc.main.cidr_block]
  }
 
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

// Next.js API route with aggressive caching
export async function GET(request: Request) {
  const { searchParams } = new URL(request.url);
  const category = searchParams.get('category');
 
  const products = await fetchProductsByCategory(category);
 
  return new Response(JSON.stringify(products), {
    status: 200,
    headers: {
      'Content-Type': 'application/json',
      // Browser caches for 5 minutes
      // CloudFront caches for 1 hour
      // Stale-while-revalidate allows serving stale content during revalidation
      'Cache-Control': 'public, max-age=300, s-maxage=3600, stale-while-revalidate=86400',
      // Vary by category to cache different responses
      'Vary': 'Accept-Encoding',
    },
  });
}

resource "aws_cloudfront_distribution" "api" {
  enabled             = true
  price_class         = "PriceClass_100"  # US/Europe only for lower costs
  http_version        = "http2and3"
  is_ipv6_enabled     = true
 
  origin {
    domain_name = aws_lb.api.dns_name
    origin_id   = "api-alb"
 
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
 
    # Custom header to verify requests come from CloudFront
    custom_header {
      name  = "X-Origin-Verify"
      value = random_password.origin_verify.result
    }
  }
 
  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
    cached_methods         = ["GET", "HEAD", "OPTIONS"]
    target_origin_id       = "api-alb"
    viewer_protocol_policy = "redirect-to-https"
    compress               = true  # Reduce bandwidth
 
    forwarded_values {
      query_string = true
      headers      = ["Authorization", "Accept"]
 
      cookies {
        forward = "none"
      }
    }
 
    # Respect Cache-Control headers from origin
    min_ttl     = 0
    default_ttl = 3600
    max_ttl     = 86400
 
    # Enable response compression
    compress = true
  }
 
  # Cache API responses based on query strings
  ordered_cache_behavior {
    path_pattern           = "/api/products*"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "api-alb"
    viewer_protocol_policy = "redirect-to-https"
    compress               = true
 
    forwarded_values {
      query_string = true
      query_string_cache_keys = ["category", "page", "limit"]
 
      headers = []
 
      cookies {
        forward = "none"
      }
    }
 
    min_ttl     = 300
    default_ttl = 3600
    max_ttl     = 86400
  }
 
  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }
 
  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate.cert.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

apiVersion: v1
kind: Service
metadata:
  name: payment-service
  annotations:
    # Enable topology-aware routing
    service.kubernetes.io/topology-aware-hints: auto
spec:
  selector:
    app: payment-service
  ports:
    - port: 8080
      targetPort: 8080
  # Prefer routing to same-zone endpoints
  internalTrafficPolicy: Local  # For cluster-internal traffic only

apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-service
spec:
  replicas: 9  # 3 per AZ
  selector:
    matchLabels:
      app: payment-service
  template:
    metadata:
      labels:
        app: payment-service
    spec:
      # Spread pods evenly across AZs
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: payment-service
 
      containers:
        - name: app
          image: payment-service:v1.2.3
          resources:
            requests:
              memory: "256Mi"
              cpu: "250m"
            limits:
              memory: "512Mi"
              cpu: "500m"

# Primary RDS instance in AZ-A
resource "aws_db_instance" "primary" {
  identifier        = "app-db-primary"
  instance_class    = "db.r6g.xlarge"
  engine            = "postgres"
  engine_version    = "15.4"
  multi_az          = true  # Standby in different AZ
 
  availability_zone = "us-east-1a"
 
  # ... other config
}
 
# Read replica in same AZ as application tier
resource "aws_db_instance" "read_replica" {
  identifier             = "app-db-read-replica-1a"
  instance_class         = "db.r6g.xlarge"
  replicate_source_db    = aws_db_instance.primary.id
 
  # Place in same AZ as application
  availability_zone      = "us-east-1a"
 
  # ... other config
}
 
# Application auto-scaling group in AZ-A
resource "aws_autoscaling_group" "app" {
  name                = "app-asg-1a"
  vpc_zone_identifier = [aws_subnet.private_1a.id]
  min_size            = 2
  max_size            = 10
  desired_capacity    = 4
 
  # ... other config
}

// Database connection configuration
import { Pool } from 'pg';
 
const primaryPool = new Pool({
  host: process.env.DB_PRIMARY_ENDPOINT,
  database: 'app',
  max: 20,
});
 
const readPool = new Pool({
  // Use read replica in same AZ for read queries
  host: process.env.DB_READ_REPLICA_ENDPOINT,
  database: 'app',
  max: 20,
});
 
// Route queries appropriately
export async function getUser(userId: string) {
  // Read from replica (same AZ, no transfer cost)
  const result = await readPool.query(
    'SELECT * FROM users WHERE id = $1',
    [userId]
  );
  return result.rows[0];
}
 
export async function updateUser(userId: string, data: any) {
  // Write to primary (may cross AZ)
  await primaryPool.query(
    'UPDATE users SET name = $1, updated_at = NOW() WHERE id = $2',
    [data.name, userId]
  );
}

resource "aws_lb_target_group" "app" {
  name     = "app-tg"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
 
  health_check {
    enabled             = true
    path                = "/health"
    healthy_threshold   = 2
    unhealthy_threshold = 2
  }
 
  # Enable connection draining
  deregistration_delay = 30
}
 
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.app.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS-1-2-2017-01"
  certificate_arn   = aws_acm_certificate.cert.arn
 
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

// Express.js with compression middleware
import express from 'express';
import compression from 'compression';
 
const app = express();
 
// Enable gzip compression for all responses
app.use(compression({
  // Only compress responses larger than 1KB
  threshold: 1024,
  // Compression level (1-9, higher = better compression, slower)
  level: 6,
  // Only compress these content types
  filter: (req, res) => {
    if (req.headers['x-no-compression']) {
      return false;
    }
    return compression.filter(req, res);
  },
}));
 
app.get('/api/products', async (req, res) => {
  const products = await getProducts();
 
  // Response will be automatically gzipped
  res.json(products);
});

import { CloudWatchClient, PutMetricDataCommand } from '@aws-sdk/client-cloudwatch';
 
const cloudwatch = new CloudWatchClient({});
 
// Track outbound bytes in your application
export async function trackDataTransfer(
  service: string,
  bytes: number,
  transferType: 'cross-az' | 'internet' | 'same-az'
): Promise<void> {
  await cloudwatch.send(new PutMetricDataCommand({
    Namespace: 'CustomApp/DataTransfer',
    MetricData: [{
      MetricName: 'BytesTransferred',
      Value: bytes,
      Unit: 'Bytes',
      Timestamp: new Date(),
      Dimensions: [
        { Name: 'Service', Value: service },
        { Name: 'TransferType', Value: transferType },
      ],
    }],
  }));
}
 
// Example: Track API response size
app.get('/api/orders', async (req, res) => {
  const orders = await getOrders();
  const response = JSON.stringify(orders);
 
  // Track outbound bandwidth
  await trackDataTransfer('api', Buffer.byteLength(response), 'internet');
 
  res.json(orders);
});

# S3 bucket for flow logs
resource "aws_s3_bucket" "flow_logs" {
  bucket = "vpc-flow-logs-${var.account_id}"
}
 
# VPC Flow Logs configuration
resource "aws_flow_log" "main" {
  vpc_id          = aws_vpc.main.id
  traffic_type    = "ALL"
  iam_role_arn    = aws_iam_role.flow_logs.arn
  log_destination = aws_s3_bucket.flow_logs.arn
  log_format      = "$${account-id} $${interface-id} $${srcaddr} $${dstaddr} $${srcport} $${dstport} $${protocol} $${packets} $${bytes} $${start} $${end} $${action} $${log-status} $${vpc-id} $${subnet-id} $${instance-id} $${tcp-flags} $${type} $${pkt-srcaddr} $${pkt-dstaddr} $${region} $${az-id} $${sublocation-type} $${sublocation-id}"
 
  tags = {
    Name = "vpc-flow-logs"
  }
}
 
# Athena table for querying flow logs
resource "aws_athena_database" "flow_logs" {
  name   = "vpc_flow_logs"
  bucket = aws_s3_bucket.athena_results.id
}

-- Identify top cross-AZ traffic sources
WITH cross_az_traffic AS (
  SELECT
    srcaddr,
    dstaddr,
    instance_id,
    SUM(bytes) as total_bytes,
    COUNT(*) as connection_count
  FROM vpc_flow_logs
  WHERE
    date >= DATE_ADD('day', -7, CURRENT_DATE)
    AND az_id != (
      SELECT az_id FROM vpc_flow_logs AS inner_table
      WHERE inner_table.dstaddr = vpc_flow_logs.dstaddr
      LIMIT 1
    )
  GROUP BY srcaddr, dstaddr, instance_id
)
SELECT
  instance_id,
  srcaddr,
  dstaddr,
  total_bytes / 1024 / 1024 / 1024 AS gigabytes,
  connection_count,
  (total_bytes / 1024 / 1024 / 1024 * 0.02) AS estimated_cost_usd
FROM cross_az_traffic
ORDER BY total_bytes DESC
LIMIT 100;

resource "aws_cur_report_definition" "main" {
  report_name                = "hourly-cost-usage-report"
  time_unit                  = "HOURLY"
  format                     = "Parquet"
  compression                = "Parquet"
  additional_schema_elements = ["RESOURCES"]
  s3_bucket                  = aws_s3_bucket.cur_reports.id
  s3_region                  = var.region
  s3_prefix                  = "cur"
  additional_artifacts       = ["ATHENA"]
  refresh_closed_reports     = true
  report_versioning          = "OVERWRITE_REPORT"
}

-- Monthly data transfer costs by service
SELECT
  line_item_product_code AS service,
  line_item_usage_type AS usage_type,
  SUM(line_item_usage_amount) AS total_gb,
  SUM(line_item_unblended_cost) AS cost_usd,
  DATE_FORMAT(line_item_usage_start_date, '%Y-%m') AS month
FROM cost_usage_report
WHERE
  line_item_usage_type LIKE '%DataTransfer%'
  AND year = '2025'
  AND month >= '01'
GROUP BY
  line_item_product_code,
  line_item_usage_type,
  DATE_FORMAT(line_item_usage_start_date, '%Y-%m')
ORDER BY cost_usd DESC;

import rateLimit from 'express-rate-limit';
 
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per window
  standardHeaders: true,
  legacyHeaders: false,
  message: 'Too many requests, please try again later.',
});
 
// Apply to API routes
app.use('/api/', apiLimiter);
 
// Stricter limits for expensive endpoints
const downloadLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 10, // 10 downloads per hour
  message: 'Download limit exceeded.',
});
 
app.get('/api/export/large-dataset', downloadLimiter, async (req, res) => {
  // ... expensive operation
});

resource "aws_budgets_budget" "data_transfer" {
  name              = "data-transfer-monthly-budget"
  budget_type       = "COST"
  limit_amount      = "500"
  limit_unit        = "USD"
  time_unit         = "MONTHLY"
  time_period_start = "2025-01-01_00:00"
 
  cost_filters = {
    Service = "AWS Data Transfer"
  }
 
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["ops@example.com"]
  }
 
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = ["ops@example.com", "cto@example.com"]
  }
}

resource "aws_cloudwatch_metric_alarm" "data_transfer_spike" {
  alarm_name          = "unusual-data-transfer-detected"
  comparison_operator = "GreaterThanUpperThreshold"
  evaluation_periods  = 2
  threshold_metric_id = "e1"
  alarm_description   = "Data transfer usage is anomalously high"
  alarm_actions       = [aws_sns_topic.critical_alerts.arn]
 
  metric_query {
    id          = "e1"
    expression  = "ANOMALY_DETECTION_BAND(m1)"
    label       = "DataTransfer (Expected)"
    return_data = true
  }
 
  metric_query {
    id = "m1"
 
    metric {
      metric_name = "BytesTransferred"
      namespace   = "CustomApp/DataTransfer"
      period      = 300
      stat        = "Sum"
    }
  }
}