Network design choices that quietly multiply data transfer costs

Network topology decisions made on day one often determine the data-transfer bill for the life of the environment. Cross-AZ traffic, hair-pinning through a NAT gateway, and public-path routes that could have stayed private are the three patterns I see most often turning modest application traffic into a material cost.

Cross-AZ traffic

On many clouds, traffic between availability zones inside the same region is charged. A load balancer in one AZ sending to instances in another, or a database primary and its replicas split across AZs, generates a steady transfer charge even when the total volume is not huge. Keeping chatty components inside the same AZ (or accepting the charge deliberately for availability) is a design choice that should be conscious.

NAT gateway as a multiplier

Every byte that leaves a private subnet through a NAT gateway is charged both for the data and for the gateway itself. When many services share one NAT, or when the NAT is in a different AZ from the instances, the cost compounds. I prefer one NAT per AZ for high-volume workloads and keep the instances that generate the most egress in the same AZ as their NAT.

Public vs private paths

Traffic that could stay on the private network but is forced out to a public IP and back in (or to another cloud over the internet) pays the highest rates. VPC endpoints / PrivateLink / equivalent services for S3, databases and internal APIs remove that hair-pin and the associated charge.

Finding the talkers with flow logs

VPC Flow Logs (or the equivalent) show the actual source, destination and byte counts. I filter for the highest-volume pairs and ask whether each pair could be co-located or moved to a private path. The first few findings usually repay the cost of enabling the logs.

Network design is one of the few places where a one-time topology choice has a permanent multiplier on the transfer bill. Making the high-volume paths private and same-AZ by default keeps that multiplier close to 1× instead of 3–5×. I keep a simple rule: any component that exchanges more than a few GB per day with another component should be examined for AZ placement and private connectivity. The examination takes minutes once flow logs or the provider’s traffic reports exist; the savings can last for years.