AWS Internet Gateway Cost: What You Actually Pay

Most engineers searching for "internet gateway cost" expect to find an hourly or per-GB fee. The answer surprises them:

The costs on your bill come from the data transfer flowing through the gateway — not the gateway itself. Understanding this distinction is what makes AWS networking costs confusing for most teams.

What Internet Gateway Actually Is (and Isn't)

An Internet Gateway (IGW) is a horizontally-scaled, redundant AWS-managed component that allows communication between your VPC and the internet. AWS doesn't charge for the gateway because it doesn't provision dedicated hardware for you — it's shared infrastructure.

What AWS does charge for is the EC2 data transfer that flows through the gateway. That charge is billed against the EC2 service, not the VPC service, which is why it doesn't show up as "Internet Gateway" on your bill.

Internet Gateway Pricing: The Real Numbers

On your AWS bill these charges appear as DataTransfer-Out-Bytes under the EC2 service, not under VPC. This is the source of the confusion — you're looking for an internet gateway line item that doesn't exist.

Internet Gateway vs NAT Gateway: Cost Comparison

This is where many teams get confused. Both gateways handle internet traffic, but they serve different purposes and have very different cost structures.

Where Internet Egress Costs Come From in Practice

Internet egress through an IGW is charged to the EC2 instance sending the traffic. Common sources that appear on bills:

• EC2 instances in public subnets serving web traffic to users
• Application Load Balancers responding to client requests
• EC2 downloading from the internet — package managers, Docker pulls from Docker Hub, GitHub
• S3 via IGW — if your S3 buckets are public or you haven't added a VPC endpoint, S3 traffic from private subnets goes through NAT and then out via IGW

The last point is critical. S3 is the most common hidden source of internet egress cost. When EC2 in a private subnet calls S3 without a VPC endpoint, the traffic goes: EC2 → NAT Gateway → Internet Gateway → S3. You pay both NAT processing and EC2 egress, even though S3 is an AWS service.

How to Find Your Internet Egress Cost

In AWS Cost Explorer, filter by Service = "EC2" and Usage Type = "DataTransfer-Out-Bytes". This shows total egress. To find which instances are responsible, you need VPC Flow Logs:

# Find top egress sources by IP
SELECT srcaddr, sum(bytes)/1073741824.0 as gb
FROM vpc_flow_logs
WHERE year='2026' AND month='06'
  AND action='ACCEPT'
  AND dstaddr NOT LIKE '10.%'
  AND dstaddr NOT LIKE '172.16.%'
  AND dstaddr NOT LIKE '192.168.%'
GROUP BY srcaddr
ORDER BY gb DESC
LIMIT 20;

This query filters to internet-destined traffic (excluding RFC 1918 private ranges) and shows your top 20 egress sources by GB. The srcaddr values are the private IPs of your EC2 instances or NAT Gateways.

How to Reduce Internet Egress Costs

• S3 VPC Gateway Endpoint — eliminates S3 egress charges entirely for same-region S3. Free.
• CloudFront in front of EC2 — CloudFront-to-origin traffic is free. CloudFront egress to users is cheaper than direct EC2 egress at volume.
• Cache aggressively — every cache hit is a byte you don't pay egress on.
• Compress responses — gzip/brotli compression reduces bytes transferred.
• Move workloads closer to users — cross-region egress ($0.02/GB) adds up on top of standard egress.

Getting Started