Review Transit Gateway and inter-AZ transfer costs
On this page
This check is due for a source refresh. Confirm the current documentation before you rely on provider-specific details.
Avoid misassigning account costs or counting traffic twice. Match each Transit Gateway attachment's hourly charge to its billed owner, then review per-GB processing separately from data transfer. Skip only when Transit Gateway is outside the charges under review.
What you need first
- Tool
- Use the AWS Command Line Interface (AWS CLI), a terminal tool that calls AWS services. It must be installed and configured. Run the Bash-compatible command below to list attachments for one Transit Gateway and Region.
- Access
- Ask an authorized AWS networking colleague for the read-only attachment inventory and CloudWatch traffic results for your scope. Attachment owners can view only their own attachment metrics; the gateway owner's account receives all attachment metrics.
- If you do not use that tool
- Send the gateway owner your Region, Transit Gateway ID, and billing period with UTC boundaries. Request attachment IDs, types, resource owners, gateway owners, states, and CloudWatch BytesIn and BytesOut using Sum for each attachment over that period.
Why this is worth a look
Low traffic does not stop attachment-hour charges. AWS billing starts when the gateway owner accepts a VPC attachment and stops when it is deleted; each partial VPC attachment hour is billed as a full hour. Processing is charged per GB sent from VPC, Direct Connect, VPN, or Network Firewall attachments into the gateway, with 1 GB equal to 1024 MB. Traffic from a peering attachment into a gateway has no Transit Gateway processing charge, but standard data transfer charges can still apply.
Run these commands
BASHReplace REGION and TRANSIT_GATEWAY_ID, then run this read-only AWS CLI command. It lists identifiers, resource owners, gateway owners, types, and states for one gateway. It has no billing-period filter and returns no hours, byte totals, or charges.
#!/usr/bin/env bash
set -euo pipefail
# Replace REGION and TRANSIT_GATEWAY_ID with your review scope.
aws ec2 describe-transit-gateway-attachments \
--region REGION \
--filters Name=transit-gateway-id,Values=TRANSIT_GATEWAY_ID \
--query 'TransitGatewayAttachments[].{Attachment:TransitGatewayAttachmentId,Type:ResourceType,Resource:ResourceId,ResourceOwner:ResourceOwnerId,TransitGatewayOwner:TransitGatewayOwnerId,State:State}' \
--output table \
--no-cli-pagerHow to confirm it
- 01
Set the account, Region, and period
Record the Transit Gateway ID, Region, accounts, and billing period with UTC start and end times. Run the command for every gateway in scope, or request the same inventory from each gateway owner.
- 02
Assign hourly charges by attachment type
Match each attachment to its billed owner. VPC attachments bill the VPC owner; VPN and Connect attachments bill the Transit Gateway owner; Direct Connect attachments bill the Direct Connect Gateway owner; network function attachments bill the Network Firewall owner. Each gateway owner pays hourly for its peering attachment.
- 03
Check hours separately from traffic
Request retained acceptance and deletion records for VPC attachments billed during the period, including attachments absent from the current inventory. Compare them with hourly charges and count partial VPC hours as full hours. Do not use low byte counts as evidence that hourly billing should stop.
- 04
Read traffic in the billed direction
Request CloudWatch BytesIn and BytesOut with Sum for each attachment over the same UTC period. BytesIn is received by the gateway from the attachment; BytesOut is sent from the gateway to the attachment. Use BytesIn as the processing signal, not an invoice total, and do not add both boundaries of one flow. Connect and Private IP VPN have no additional processing charge beyond their underlying attachment.
- 05
Confirm the transfer rule for the path
Trace the source, destination, and any peering gateway before assigning transfer charges. For inter-Region peering, identify the sending side and keep outbound inter-Region transfer separate from processing. Request attachment-plus-Availability Zone metrics for VPC attachments when investigating traffic location. Apply the EC2 data transfer rule for the exact path instead of assuming every cross-zone byte is charged.
Before making changes
Treat this as a reconciliation aid, not a bill calculation. Assume the inventory and CloudWatch results cover the same UTC window and that your colleague can see every attachment in scope. The inventory shows current properties, not historical billed hours. CloudWatch provides timestamped monitoring bytes, not invoice lines; per-Availability Zone metrics are available only for VPC attachments and do not by themselves establish a transfer charge. Review multicast separately because processing also applies per GB received by each multicast receiver instance.