PacketSensei

Cross-AZ data transfer: How to Find Them and What They Cost

PacketSensei

Cross-AZ data transfer are a per-gigabyte charge in both directions on traffic between availability zones, invisible on the bill until you know what to look for. They are one of the most reliable sources of pure waste in an AWS account, because nothing in the console flags them and nothing fails when they exist — the bill simply stays higher than it needs to be.

This page covers what they cost, the command that lists yours, and — importantly — what to check before deleting anything.

What they are and why they linger

Traffic between availability zones within a region is charged in both directions — roughly $0.01 per GB out and $0.01 per GB in, so about $0.02 per GB round trip. Traffic within a single availability zone, using private addresses, is free.

Nothing announces it. There is no cross-AZ resource, no console page, and the bill reports it as a regional data transfer line that most people never open. Meanwhile every architectural best practice — spread across three AZs — actively generates it.

The AWS Cost and Usage Report is where it becomes visible, under usage types matching DataTransfer-Regional-Bytes.

What they cost

A chatty microservice architecture moving 10 TB a month between zones costs about $200 a month. A Kubernetes cluster where pods are scheduled without topology awareness routinely does far more, because roughly two-thirds of all service-to-service calls land in a different zone by default with three zones in play.

Replication traffic is the other large contributor: Multi-AZ RDS, Kafka replicas, and Elasticsearch shards all replicate across zones continuously by design.

Finding yours

# Cost Explorer, grouped by usage type — look for DataTransfer-Regional-Bytes.
aws ce get-cost-and-usage \
  --time-period Start=$(date -u -d '30 days ago' +%F),End=$(date -u +%F) \
  --granularity MONTHLY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=USAGE_TYPE \
  --query 'ResultsByTime[].Groups[?contains(Keys[0], `Regional-Bytes`)].[Keys[0],Metrics.UnblendedCost.Amount]' \
  --output text

To find which traffic, VPC Flow Logs plus Athena is the tool. Enrich the flow log with the subnet-to-AZ mapping and group by source and destination AZ; the top talkers are usually a small number of service pairs.

For Kubernetes specifically, check whether topology-aware routing is on:

kubectl get svc my-service -o jsonpath='{.metadata.annotations}'
# look for service.kubernetes.io/topology-mode: Auto

Before you delete

Cross-AZ traffic is often the price of availability, not waste. Multi-AZ RDS replication, quorum writes across zones, and load balancers distributing across zones exist to survive a zone failure. Eliminating them saves money and removes the resilience you were paying for.

The waste is the avoidable portion: service-to-service chatter that has no reason to cross a zone boundary, and clients reaching an endpoint in the wrong zone because nothing told them to prefer local.

Be careful with zone-local designs. Pinning a workload to one availability zone removes the cost and reintroduces the single point of failure.

Stopping them coming back

In Kubernetes, enable topology-aware routing so a service call prefers an endpoint in the caller’s own zone, and use topology spread constraints so replicas exist in every zone to route to.

Elsewhere: enable cross-zone load balancing deliberately rather than by default (it is on by default for ALB and off for NLB, and it is billable for NLB); place interface VPC endpoints in every zone that uses them so traffic does not cross to reach an endpoint; and keep chatty service pairs co-located where the availability requirement allows.

Most importantly, make it visible. A Cost Explorer report filtered to regional data transfer, reviewed monthly, turns an invisible line into a managed one.

Prices quoted are us-east-1 list rates, last checked on 2026-08-22, and are shown with the arithmetic so you can substitute the rates for your own region. Always confirm against the AWS pricing page before acting on a number.