Data Transfer & NAT Gateway Cost Reduction
The cost line nobody owns, and the one most often accidental.
- Turnaround
- 3–5 business days
- Who it is for
- Teams where "EC2-Other" or data transfer is a top-three line item.
01 — The problem
Data transfer charges are architectural side effects. Cross-AZ chatter, NAT Gateway egress for traffic that should never have left the VPC, and S3 access routed the expensive way — none of it shows up as a service you can switch off.
02 — What is included
Exactly what you get, and nothing vague.
- VPC Flow Logs analysis to find what is actually crossing AZ boundaries
- VPC Endpoint candidates for S3, DynamoDB and other AWS services
- NAT Gateway placement review — per-AZ versus shared, and the trade-off
- Cross-region replication audit: what is replicating and whether it needs to
- CloudFront and egress path review for public traffic
03 — What this usually finds
The recurring ones, named up front.
- S3 traffic traversing a NAT Gateway instead of a VPC Endpoint
- Services chatting across AZs because placement was never constrained
- Replication to a DR region nobody has tested or needs
- Container image pulls from the public internet on every scale-out
Listed because they recur, not because they are guaranteed. The audit reports what is actually there.
Next step
Twenty minutes to find out whether this is worth doing.
Every engagement runs under a signed mutual NDA with a read-only IAM role. If the audit would not pay for itself, I will say so on the call.