SAA-C03
Deep Dive
Network costs are a frequent trap on the SAA-C03. NAT Gateway can be surprisingly expensive for workloads that access S3 or DynamoDB heavily. VPC Endpoints eliminate those costs. CloudFront reduces S3 egress. Understanding which traffic is billed and how to avoid it is key to cost-optimized architectures.
Contents
General rule: ingress into AWS is free. Egress out of AWS is billed (to the internet). Transfer between services in the same region can be free or low-cost depending on the AZs.
Internet → AWS (ingress)
Uploading data to S3, sending requests to EC2, etc. Always free.
AWS → Internet (egress)
EC2, S3, etc. sending data to the client. The main network cost.
Between AZs same region
EC2 in AZ-a sending to EC2 in AZ-b. Charged in both directions.
Between services same AZ
EC2 and RDS in the same AZ communicating over private IP.
VPC Peering same region
Same as inter-AZ. If they are in the same AZ, it can be free.
AWS Direct Connect (outbound data)
Much cheaper than internet egress. DX advantage for large volumes.
CloudFront → Internet
Cheaper than direct egress from S3/EC2. Cost reduction with a CDN.
NAT Gateway is expensive if not optimized. It charges per hour of availability (~$0.045/hr) and per GB processed (~$0.045/GB). For workloads that process large volumes of data to S3 or DynamoDB, the cost skyrockets.
Real-world cost example
Scenario: 10 EC2 instances in a private subnet. Each processes 100 GB/day of data to S3.
NAT GW per hour: $0.045 × 24 × 30 = $32.40/month
Data processed: $0.045 × 100 GB × 10 × 30 = $1,350/month
Total: ~$1,382/month just for NAT Gateway
With an S3 Gateway Endpoint: $0 for data to S3. You only pay for the NAT GW if you need internet access.
When a NAT Gateway is necessary vs when to avoid it
You need to reach the public internet from a private subnet (OS updates, external APIs)
Accessing AWS services with no Gateway endpoint available (most services)
Accessing S3 or DynamoDB → use a Gateway Endpoint (free, removes the need for a NAT GW for that traffic)
Accessing AWS services with an Interface Endpoint available → use an Interface Endpoint (cheaper than a NAT GW for high volume)
Traffic only within the VPC or between VPCs → doesn't need a NAT GW at all
VPC Endpoints let resources in private subnets reach AWS services without going through a NAT Gateway or the internet. There are two types with very different cost models.
Gateway Endpoint
Services
Only S3 and DynamoDB
Cost
Completely FREE
How it works
Adds an entry to the subnet's Route Table. Traffic to S3/DynamoDB goes directly without passing through the NAT GW.
Exam trap
Does not work across accounts or from on-premises. Only from within the VPC.
Interface Endpoint (PrivateLink)
Services
Almost all AWS services (EC2 API, SSM, Secrets Manager, KMS, etc.)
Cost
~$0.01/hr per AZ + $0.01/GB processed
How it works
Creates an ENI (Elastic Network Interface) in the subnet. DNS resolves the endpoint to the ENI's private IP.
Exam trap
Does work from on-premises via DX or VPN. More expensive than a Gateway Endpoint but cheaper than a NAT GW for high volume.
CloudFront acts as a CDN in front of S3 or an HTTP origin. The traffic between CloudFront and the origin (S3) is free within AWS. Egress flows from CloudFront to users, at a lower rate than direct egress from S3.
S3 direct → user
~$0.09/GB egressS3 → CloudFront → user
~$0.0085/GB + cache hit = $0Additionally: CloudFront + S3 OAC prevents users from accessing S3 directly. S3 only responds to CloudFront. This drives S3 egress down to practically $0 (you only pay CloudFront's egress, which is cheaper and benefits from caching).
CloudFront Price Classes
Price Class 100 (US/Europe only): cheapest. Price Class 200 (+ Asia/Latam): mid-tier. Price Class All (all edge locations): most complete but most expensive. Choose based on where your users are.
EC2/Lambda in a private subnet accessing S3 heavily
Problem
NAT Gateway charges $0.045/GB — very expensive for TBs of data
Solution
S3 Gateway Endpoint (free). Add an entry in the Route Table. Removes the NAT GW cost for S3 traffic.
Application with many global users downloading files from S3
Problem
Direct S3 egress = $0.09/GB × TB = thousands of dollars
Solution
Put CloudFront in front of S3. Cache hit = $0 from S3. CF egress = $0.0085/GB. 90%+ reduction.
Microservices across multiple AZs communicate heavily with each other
Problem
Inter-AZ traffic = $0.01/GB in each direction. With TBs of data, it adds up fast.
Solution
Place frequently-communicating services in the same AZ. Or use PrivateLink/endpoints to reduce hops.
Lambda accesses Secrets Manager, KMS, or SSM frequently
Problem
Without an endpoint, traffic goes over the internet (NAT GW or public IP). NAT GW cost plus latency.
Solution
Interface Endpoints for Secrets Manager, KMS, SSM. Traffic stays within the VPC.
S3/DynamoDB → always a Gateway Endpoint
If the architecture has private subnets accessing S3 or DynamoDB, use a Gateway Endpoint. It's free, removes the need for a NAT GW for that traffic, and reduces latency (a more direct route).
Ingress free, egress expensive
Uploading data to AWS is free. Downloading from AWS is billed. When the scenario mentions users downloading data at scale, the cost solution involves CloudFront.
Inter-AZ charges $0.01/GB
Traffic between AZs within the same region has a cost. For workloads with very frequent inter-service communication, consider placing them in the same AZ (trading off availability).
CloudFront + S3 = less egress + more secure
CloudFront with S3 OAC blocks direct access to the bucket. CloudFront's egress is cheaper. Cache hits cost $0 from S3. Triple benefit: security + performance + cost.
Direct Connect for large transfer volumes
Egress via DX (~$0.02/GB) is much cheaper than via the internet (~$0.09/GB). For workloads that transfer TBs regularly, DX pays for itself quickly versus internet cost.
Visualizes the two traffic paths and their cost difference for reaching S3 from a private subnet.
Did you get this topic?
Test what you just learned
A company has 20 EC2 instances in private subnets that process 500 GB of data daily from S3 and 100 GB from DynamoDB. They currently use a NAT Gateway. What is the most effective way to reduce network costs?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.