AWS Data Transfer Cheat Sheet 🗺️

Private EC2 → NAT Gateway → Internet → S3

You pay:
NAT Gateway processing: $0.045/GB
Data transfer out: $0.09/GB
Total: $0.135/GB 😱

Fix with VPC Endpoint:
Private EC2 → VPC Endpoint → S3
Total: $0.00/GB ✅

# FREE S3 access from private subnets
resource "aws_vpc_endpoint" "s3" {
vpc_id = aws_vpc.main.id
service_name = "com.amazonaws.${var.region}.s3"
vpc_endpoint_type = "Gateway"

route_table_ids = var.private_route_table_ids

tags = { Name = "s3-gateway-endpoint" }
}

# FREE DynamoDB access from private subnets
resource "aws_vpc_endpoint" "dynamodb" {
vpc_id = aws_vpc.main.id
service_name = "com.amazonaws.${var.region}.dynamodb"
vpc_endpoint_type = "Gateway"

route_table_ids = var.private_route_table_ids

tags = { Name = "dynamodb-gateway-endpoint" }
}

# Pin your app and its cache to the same AZ
resource "aws_instance" "app" {
subnet_id = aws_subnet.private_az_a.id # AZ-a
# ...
}

resource "aws_elasticache_replication_group" "redis" {
preferred_cache_cluster_azs = ["us-east-1a"] # Same AZ
# ...
}

# For ECS — use placement constraints
resource "aws_ecs_service" "api" {
# ...
placement_constraints {
type = "memberOf"
expression = "attribute:ecs.availability-zone == us-east-1a"
}
}

# Don't assign public IPs to instances that don't need them
resource "aws_instance" "backend" {
subnet_id = aws_subnet.private.id
associate_public_ip_address = false # 👈 No public IP

tags = { Name = "backend-server" }
}

# Use internal ALB for service-to-service communication
resource "aws_lb" "internal" {
name = "internal-api"
internal = true # 👈 Internal, no internet-facing
load_balancer_type = "application"
subnets = var.private_subnet_ids
}

resource "aws_cloudfront_distribution" "assets" {
enabled = true
is_ipv6_enabled = true

origin {
domain_name = aws_s3_bucket.assets.bucket_regional_domain_name
origin_id = "s3-assets"
origin_access_control_id = aws_cloudfront_origin_access_control.s3.id
}

default_cache_behavior {
allowed_methods = ["GET", "HEAD"]
cached_methods = ["GET", "HEAD"]
target_origin_id = "s3-assets"
viewer_protocol_policy = "redirect-to-https"

forwarded_values {
query_string = false
cookies { forward = "none" }
}

# Cache for 24 hours
min_ttl = 0
default_ttl = 86400
max_ttl = 604800
}

restrictions {
geo_restriction { restriction_type = "none" }
}

viewer_certificate {
cloudfront_default_certificate = true
}

tags = { Name = "asset-cdn" }
}

resource "aws_cloudfront_origin_access_control" "s3" {
name = "s3-assets-oac"
origin_access_control_origin_type = "s3"
signing_behavior = "always"
signing_protocol = "sigv4"
}

resource "aws_s3_bucket_replication_configuration" "selective" {
bucket = aws_s3_bucket.primary.id
role = aws_iam_role.replication.arn

rule {
id = "critical-data-only"
status = "Enabled"

# Only replicate what matters, not everything
filter {
prefix = "critical/" # 👈 Not the entire bucket
}

destination {
bucket = aws_s3_bucket.replica.arn
storage_class = "STANDARD_IA" # Cheaper storage in replica
}
}
}

# monitoring/data-transfer.tf

resource "aws_ce_anomaly_monitor" "data_transfer" {
name = "data-transfer-anomaly-monitor"
monitor_type = "DIMENSIONAL"
monitor_dimension = "SERVICE"
}

resource "aws_ce_anomaly_subscription" "data_transfer" {
name = "data-transfer-alerts"

monitor_arn_list = [aws_ce_anomaly_monitor.data_transfer.arn]

frequency = "DAILY"

threshold_expression {
dimension {
key = "ANOMALY_TOTAL_IMPACT_ABSOLUTE"
values = ["50"] # Alert if anomaly > $50
match_options = ["GREATER_THAN_OR_EQUAL"]
}
}

subscriber {
type = "EMAIL"
address = var.alert_email
}
}

# CloudWatch dashboard for data transfer visibility
resource "aws_cloudwatch_dashboard" "data_transfer" {
dashboard_name = "data-transfer-costs"

dashboard_body = jsonencode({
widgets = [
{
type = "metric"
x = 0
y = 0
width = 12
height = 6
properties = {
metrics = [
["AWS/EC2", "NetworkOut", { stat = "Sum", period = 86400 }],
["AWS/EC2", "NetworkIn", { stat = "Sum", period = 86400 }]
]
title = "EC2 Network Traffic (Daily)"
region = var.region
}
},
{
type = "metric"
x = 12
y = 0
width = 12
height = 6
properties = {
metrics = [
["AWS/NATGateway", "BytesOutToDestination", { stat = "Sum", period = 86400 }],
["AWS/NATGateway", "BytesOutToSource", { stat = "Sum", period = 86400 }]
]
title = "NAT Gateway Traffic (Daily)"
region = var.region
}
}
]
})
}

# Check data transfer costs by service (last 30 days)
aws ce get-cost-and-usage \
--time-period Start=$(date -u -d '30 days ago' +%Y-%m-%d),End=$(date -u +%Y-%m-%d) \
--granularity MONTHLY \
--metrics BlendedCost \
--filter '{
"Dimensions": {
"Key": "USAGE_TYPE_GROUP",
"Values": ["EC2: Data Transfer - Internet (Out)",
"EC2: Data Transfer - Region to Region (Out)",
"EC2: Data Transfer - Inter AZ"]
}
}' \
--group-by Type=DIMENSION,Key=USAGE_TYPE_GROUP \
--output table