AWS Price List API · On-Demand · USD
AWS Networking Services Pricing
On-Demand rates from the AWS Price List API (bulk), organized by service. All amounts are in US dollars (USD) and exclude tax. Use these tables to compare Regions and estimate monthly costs; for quotes, check the AWS Pricing Calculator.
Price List publishedUTCLoading…
data.json)…Elastic Load Balancing
You pay for each hour a load balancer runs (partial hours count as a full hour) and for the capacity units (LCUs) it uses. Each hour, LCUs are charged on a single dimension: the one with the highest usage. Only Classic Load Balancer charges per GB of data processed instead of LCUs.
The highest of four dimensions: new connections, active connections, processed bytes and rule evaluations.
Three dimensions: new connections/flows, active connections/flows and processed bytes. TCP, UDP and TLS traffic are calculated separately and added together.
Three dimensions: new connections/flows, active connections/flows and processed bytes. The hourly charge applies per AZ.
Reserved LCUs are billed hourly whether used or not; usage above the reservation is billed at the regular LCU rate.
VPC Lattice
A VPC Lattice service is billed on three components: an hourly charge per service, a per-GB data processing charge, and a charge for the number of requests (HTTP/HTTPS listeners) or TCP connections (TLS listeners). VPC resources (resource configurations) attached to a service network have their own hourly per-resource charge and per-GB processing charge.
Charged for every hour (including partial hours) a VPC Lattice service is provisioned.
Per GB of requests received and responses sent by the service combined. No separate cross-AZ data transfer charge applies.
The first 300,000 per service per hour are free (Always Free); only usage above that is charged per million.
Consumers pay an hourly charge per resource added to a service network plus tiered per-GB processing; providers pay per GB processed by the Resource Gateway.
API Gateway
Each API type is billed per request. REST APIs and HTTP APIs are charged on requests received; WebSocket APIs on messages sent and received plus connection minutes. Rates are tiered and drop as monthly usage grows. Enabling caching on a REST API adds an hourly charge by cache size.
Per million API calls received. Rates change at 333 million, 1 billion and 20 billion calls per month.
Per million requests, metered in 512 KB increments. The rate drops above 300 million requests per month.
Messages (per million, in 32 KB increments) and connection minutes (per million) are charged separately.
Hourly charge by REST API stage cache size (0.5–237 GB).
CloudFront
CloudFront charges for data transferred out from edge locations to viewers (DTO) and for the number of HTTP/HTTPS requests. Rates depend on the geographic group of the edge location that served the request and on monthly volume, not on the Region. Flat-rate plans with a fixed monthly price regardless of usage are also available.
Per GB, edge → internet. Seven tiers per geographic group; the first 1 TB per month across all groups is free.
HTTP and HTTPS requests are counted separately per 10,000. The first 10 million per month are free.
Edge → origin transfer (uploads such as POST and PUT) has its own per-GB rate. Transfer from AWS origins to the edge is free.
A fixed monthly price per distribution that bundles CDN, WAF, DDoS protection, Route 53 DNS and more, with no overage charges.
Global Accelerator
Each accelerator incurs a fixed hourly fee, and traffic incurs a per-GB DT-Premium on top of standard data transfer rates. DT-Premium is charged only in the direction with more traffic each hour (the dominant direction).
Charged for every hour (including partial hours) an accelerator exists, regardless of Region.
Determined by the combination of the Region group hosting the endpoint and the edge location group the client connects to.
Transit Gateway
An hourly charge per attachment plus a per-GB data processing charge for traffic sent to the transit gateway. The transit gateway itself has no charge; inter-Region traffic over a peering attachment also incurs EC2 inter-Region data transfer charges.
VPC, VPN, Direct Connect gateway, Connect and peering attachments all share the same rate (exceptions in the notes).
Based on traffic entering the transit gateway from an attachment. Traffic arriving over a peering attachment has no processing charge.
Data processing is charged for every GB received by multicast receiver instances.
Cloud WAN
Made up of an hourly Core Network Edge (CNE) charge, hourly attachment and peering charges, and a per-GB data processing charge. Standard data transfer charges for inter-Region, internet and Direct Connect segments apply separately.
Charged hourly for each Region (edge location) included in the core network policy.
Charged hourly per VPC, Connect, Site-to-Site VPN and Transit Gateway peering attachment.
Charged per GB of traffic sent from VPC and VPN attachments into Cloud WAN.
PrivateLink
An interface endpoint is charged hourly for each AZ it is deployed in, and processed data is charged per GB in tiers based on monthly volume per Region. Gateway Load Balancer endpoints have their own rates.
Charged hourly per endpoint × number of AZs. Deploying in 3 AZs costs three times as much.
Tiers apply to the combined volume of all interface endpoints in the Region.
Per endpoint hour + per GB processed. The Gateway Load Balancer behind it is billed separately.
Direct Connect
There are two charges: port hours and data transfer out (DTO). Port hours are billed while the connection is available, and only locations in Japan have different rates. DTO applies only to traffic leaving an AWS Region toward a Direct Connect location; inbound traffic is free.
Dedicated connections are provisioned by AWS, Hosted connections by a Direct Connect Partner. Partial hours count as a full hour.
The per-GB rate is set by the combination of the source Region and the geographic group of the DX location. Private VIF and public VIF rates are the same.
VIFs with SiteLink enabled add an hourly per-VIF charge and a per-GB charge for transfer between DX locations.
AWS Interconnect
Each Interconnect connection is billed hourly based on the bandwidth you choose and a pricing tier (1–5) that is determined automatically. There is no per-GB data transfer charge. For multicloud, the other cloud (Google Cloud, OCI) bills its side separately.
For multicloud, set by the AWS Region the traffic originates from and the interconnect's local Region; for last mile, by the distance between the Interconnect metro and the farthest AWS Region. Only the single highest tier applies.
Billed in 1-hour increments (rounded up) from when the connection is created until it is deleted.
Attaching a Direct Connect gateway to a Cloud WAN core network raises the tier based on the farthest CNE.
Site-to-Site VPN
Site-to-Site VPN is billed primarily per VPN connection hour, and traffic leaving through the VPN follows EC2 data transfer rates. Accelerated VPN adds the fixed fee of two Global Accelerators per connection plus DT-Premium.
Billed per connection, each with two tunnels. Standard (up to 1.25 Gbps per tunnel) and Large (5 Gbps per tunnel) have different rates.
VPN connection + Global Accelerator fixed fee × 2 + DT-Premium (per GB). Non-accelerated VPNs have no Global Accelerator charges.
Attach multiple sites to one Concentrator; Concentrator hours and site hours are billed separately.
Client VPN
Client VPN charges for subnet association hours on the endpoint plus active client connection hours. Traffic leaving through the VPN incurs EC2 data transfer charges.
Hourly charge per subnet associated with the Client VPN endpoint.
Hourly charge per concurrently connected client.
Amazon VPC
The VPC itself is free; charges apply to features used inside it, such as NAT gateways, public IPv4 addresses, IPAM, Traffic Mirroring and Encryption Controls, and to data transfer. Inter-Region, cross-AZ and internet data transfer rates are also collected in this tab.
Billed for the hours the gateway exists and the GB it processes. A regional NAT gateway is charged hourly for each active AZ.
Hourly charge per public IPv4 address, whether in use or idle. Elastic IPs are charged the same way.
The Free Tier is free; the Advanced Tier is charged hourly per active IP address managed by IPAM.
Inter-Region transfer is paid by the source Region; cross-AZ transfer is charged per GB in each direction. Data transfer into AWS (DTI) is free.
Route 53
Route 53 is billed primarily on monthly hosted zone charges, the number of DNS queries and the number of health checks. VPC-side features (Resolver endpoints, Resolver DNS Firewall and Profiles) are priced per Region. Domain registration prices vary by TLD; see the list on the official pricing page.
Monthly charge per zone (not prorated). The rate drops after the first 25 zones. Zones with more than 10,000 records incur a monthly charge per additional record.
Per million, by routing policy. Above 1 billion per month the rate is halved. Queries to alias records that point to AWS resources are free.
AWS endpoints and other endpoints have different rates; options such as HTTPS and string matching cost extra per feature.
An hourly charge per endpoint ENI plus a charge per million queries through the endpoint. Queries resolved directly within the VPC are free.
Network Firewall
You pay an hourly charge for each AZ with a firewall endpoint and a per-GB charge for traffic processed by the endpoint. Using TLS inspection adds an hourly Advanced Inspection charge, and enabling the active threat defense managed rule group adds a per-GB charge.
Hourly charge per Region × AZ. Secondary endpoints that attach the same firewall to another VPC have a lower rate.
Per GB of traffic through the endpoint, regardless of source or destination.
An additional hourly charge per AZ while TLS inspection is in use. There is no separate per-GB charge.
For a NAT gateway on the same path, NAT gateway hourly and per-GB charges are waived 1:1 against Network Firewall endpoint hours and GB.
AWS WAF
You pay a monthly charge (prorated hourly) per web ACL and per rule (rule or rule group), plus a charge per million requests inspected. AWS Managed Rules features such as Bot Control, Fraud Control and Anti-DDoS add their own monthly subscription and request charges.
A monthly charge for each web ACL and each rule or rule group. In rule groups you create, each rule inside is also counted.
Per million requests inspected by the web ACL. The rate rises above the default 1,500 WCUs or when you raise the body inspection limit.
Bot Control, Fraud Control and Anti-DDoS have a monthly subscription per web ACL plus request charges.
Charged per 10,000 CAPTCHA attempts and per million Challenge responses.
AWS Shield
Shield Standard applies to all AWS customers at no additional cost. Shield Advanced is a one-year subscription with a monthly fee per payer account, plus usage charges by resource type on data transferred out (DTO) from protected resources.
Baseline L3/L4 DDoS protection. No sign-up or additional charge.
A fixed monthly fee based on the organization's payer account; requires a one-year commitment.
Per-GB usage charge on data out of CloudFront and Global Accelerator (global) and ELB and Elastic IP (per Region). Route 53 has no additional charge.
WAF web ACLs, rules and requests (default WCU) for protected resources are included in the subscription up to 50 billion requests per month.
Firewall Manager
Firewall Manager charges a monthly fee for each protection policy applied in each Region. WAF web ACLs, Network Firewall endpoints, DNS Firewall rule groups and AWS Config rules created by a policy are billed separately at each service's rates.
A monthly charge per policy × Region. In most Regions the rate is the same regardless of policy type.
Firewall Manager policy charges are included for Shield Advanced subscribers (AWS Config rule charges are separate).
AWS Config rules and each service resource created by a policy are billed at that service's rates.
VPC Flow Logs
Creating or enabling a flow log is free; you pay CloudWatch vended logs charges per GB depending on where the logs are delivered (CloudWatch Logs, S3 or Data Firehose), in four tiers based on monthly volume. Storage and query charges of each destination service apply separately.
Standard and Infrequent Access log classes have different rates. This is the ingestion charge; storage is billed separately.
Per GB delivered to S3. Enabling Apache Parquet conversion adds a per-GB conversion charge.
Per GB delivered to Firehose. Firehose's own charges are separate.
Reachability Analyzer
Reachability Analyzer charges per path analysis; Network Access Analyzer charges per ENI evaluated in a network access analysis. Both analyze configuration without sending packets, so there are no data transfer charges.
Charged per path analysis between a source and destination. Re-analyzing the same path counts as another analysis.
Charged per ENI evaluated in a Network Access Scope analysis.
Network Manager
Source: AWS documentation · Price List AmazonCloudWatchAWS Network Manager has no pricing page of its own. AWS documentation and blogs describe global networks, topology, Route Analyzer and Infrastructure Performance as available at no additional cost. Costs come from the CloudWatch metrics and event processing you integrate, and from underlying services such as Cloud WAN and Transit Gateway.
Global networks, Transit Gateway registration, topology and maps, Route Analyzer, viewing Infrastructure Performance
Publishing Infrastructure Performance through a CloudWatch subscription incurs CloudWatch custom metric charges per metric.
For Cloud WAN, Transit Gateway, VPN and Direct Connect pricing, see the respective tabs.
Network Flow Monitor
Network Flow Monitor consists of an hourly charge per resource monitored with the agent (EC2 instances, EKS nodes and so on) plus CloudWatch metric charges for metrics published by monitors. The companion Network Synthetic Monitor is charged hourly per monitored resource.
Hourly charge per resource whose agent sends flow data. For the first 12 months, 7,300 resource-hours (10 resources) per month are free.
Metrics published by monitors are billed at the CloudWatch custom metric rate (per metric per month).
Hourly charge per monitored resource for monitors that measure on-premises paths with probes.