How Every AWS Component Is Billed: Per Hour, Per GB, Per Request.

Summary: every AWS line item uses one of seven meters: per hour, per GB moved, per GB-month stored, per request, per unit per month, a commitment, or a pass-through tax. Once you know which meters a component uses, you know what drives its cost and which lever to pull. This guide walks through every common component with Mumbai (ap-south-1) list prices, the usage type you will see in Cost Explorer, a formula, the traps, and the fix. The biggest lesson: in a typical networking-heavy account, close to half the bill is charged per hour, whether or not any traffic flows.

1. Why read a bill by meter, not by service

Open Cost Explorer grouped by service and you see names: EC2, VPC, Network Firewall, CloudWatch. That view tells you where money goes, but not why. Two lines of the same size can behave completely differently. One rises with traffic, one with the number of things that exist, one with how long data sits around, one with how often a script calls an API.

Think of AWS as a city utility company. Some things charge rent (you pay every hour the thing exists). Some charge a toll (you pay for every GB that drives through). Some charge storage (you pay for space by the month). Some charge per ticket (you pay per API call). Most real components combine two or three of these. A NAT gateway charges rent and a toll. A load balancer charges rent and a capacity fee. Once you can see the rent and the toll separately, cost work stops being guesswork.

2. The seven meter types

3. Decoding a usage type

Cost Explorer and the Cost and Usage Report (CUR) name every meter with a usage type. Learn the shape and you can decode any line without opening a pricing page. The prefix is a region code, then the meter name.

APS3-Endpoint-Hour                 Mumbai, Network Firewall endpoint, billed in hours
APS3-Traffic-GB-Processed          Mumbai, Network Firewall, billed per GB inspected
APS3-NatGateway-Bytes              Mumbai, NAT gateway data processed
APS3-DataTransfer-Regional-Bytes   Mumbai, traffic between Availability Zones
APS3-EBS:VolumeUsage.gp3           Mumbai, gp3 disk, provisioned GB-month
USE1-APIRequest                    N. Virginia, Cost Explorer API call

APS3 is Mumbai (ap-south-1). Hyderabad (ap-south-2) has its own prefix, which is why a disaster-recovery region shows up as a separate set of lines. Global services such as Cost Explorer are priced in US East and carry a USE1 prefix wherever you call them from.

Four rules used everywhere in this guide

• A month is 730 hours. AWS uses 730 hours to turn hourly rates into monthly ones. That is where the familiar $3.65 per month for a public IPv4 address comes from ($0.005 × 730).
• Prices are list, before discounts. Savings Plans, credits and private pricing lower the effective rate. Tax is added on top.
• Hourly resources bill while idle. A firewall with no traffic, a load balancer with no targets and an unattached disk all keep their meter running.
• Data in is almost always free; data out and data sideways is not. The path a packet takes decides which per-GB meters it crosses.

4. One-page cheat sheet

Mumbai (ap-south-1) on-demand list prices, USD, October 2026. Monthly figures use 730 hours.

5. What a typical bill looks like by meter

Take a hypothetical platform team running Kubernetes on EKS in Mumbai, with a firewall in front of every VPC, a few dozen load balancers and a disaster-recovery copy in Hyderabad. Suppose its monthly bill is $20,000. Grouped by meter instead of by service, a bill like that often looks roughly like this:

The first row is the important one. Nearly half the money is decided by what exists, not by what is used. Traffic can fall to zero overnight and that half barely moves. That is why the fastest savings usually come from deleting or consolidating things, not from tuning them.

Reading the bill backwards: dollars to quantities

A useful trick is to divide each line by its list rate. The result tells you what is actually running, which is often a surprise.

"We have 50 load balancers?" is a common reaction. These are derived numbers, and they assume list price with no discount, but they turn an abstract bill into a list of things you can go and look at.

Part A. Hourly and per-GB networking

Networking is where bills quietly grow. Each component below has a fixed fee for existing plus a variable fee for traffic, and several of them sit on the same path.

AWS Network Firewall

Billed like a rented appliance. You pay for each firewall endpoint for every hour it exists, one endpoint per Availability Zone the firewall covers, and separately for every GB it inspects. Idle or busy, the endpoint fee does not change.

Formula: monthly = (endpoints × $0.395 × 730) + (GB inspected × $0.065)

Worked example (hypothetical). A two-AZ firewall with zero traffic costs 2 × $0.395 × 730 = $577 a month before it inspects a single byte. A small dev VPC with such a firewall costs about $19 a day forever. Add 20 TB of inspected traffic and you add 20,480 × $0.065 = $1,331.

NAT gateway

A managed NAT is billed for existing and for every GB it processes, in both directions. Because it is one per AZ, an environment with a NAT in each of two zones pays the hourly fee twice.

Formula: monthly = (NATs × $0.056 × 730) + (GB × $0.056)

Worked example (hypothetical). One NAT is $40.88 a month fixed. Four NATs across environments are about $164 before any data. Push 4 TB through them and add about $230.

Load balancers (ALB and NLB)

Two meters: a fixed fee for every hour the balancer exists, and a capacity fee measured in LCU (ALB) or NLCU (NLB). You are billed on whichever dimension is highest in that hour: new connections, active connections, bytes processed or rule evaluations.

Formula: monthly = (LBs × $0.0239 × 730) + (capacity units × rate)

Worked example (hypothetical). 50 load balancers cost about $870 a month in hours alone. If 30 of them carry almost no traffic, consolidating them saves around $500 a month, plus their public IPs.

EKS control plane

AWS charges a flat hourly fee per cluster for the managed control plane. Worker nodes are ordinary EC2 instances billed separately, along with their volumes and load balancers.

Formula: monthly = clusters × $0.10 × 730 = $73 per cluster.

EC2 instances

Billed per second (60-second minimum) at an hourly rate set by instance type, region and purchase option. The rate stops when the instance stops, but its disks and Elastic IPs keep billing.

Formula: monthly = instances × hourly rate × hours running (Linux, shared tenancy, on-demand).

Worked example (hypothetical). 30 t3.medium nodes at $0.0448 × 720 hours cost $32.26 each, about $968 a month. Size is linear: a c6a.4xlarge at $0.374 an hour costs exactly four times a c6a.xlarge at $0.0935.

Savings Plans and Reserved Instances

Not a service but a billing contract. You commit to a fixed $/hour for one or three years, and AWS bills matching usage at a lower rate. The commitment is charged every hour whether you use it or not, so it only saves money on usage that is truly steady.

Formula: covered usage costs the commitment rate; uncovered usage costs on-demand; unused commitment is lost.

VPC networking: public IPv4, endpoints, Transit Gateway, VPN

The "VPC" line in Cost Explorer is a mix of small hourly charges. Each is cheap, but they multiply by AZ, by VPC and by account.

Worked example (hypothetical). A hub account with a Transit Gateway and five attachments pays 5 × $51.10 = $256 a month before any traffic. Three VPN connections add $110, even if one of the tunnels carries zero bytes. Three interface endpoints across three AZs cost 9 × $9.49, about $85.

Data transfer

Data movement is metered by path, not by service. The same GB can be free, $0.01 or $0.11 depending on where it goes.

Formula: cross-AZ cost = GB × $0.01 × 2 (once leaving one AZ, once arriving in the other).

Worked example (hypothetical). A monitoring pod in one zone scrapes a busy peer in another zone and receives 2.5 TB a day. That is about 2,560 GB × $0.02 = $51 a day, or $1,500 a month, for a single misplaced pod. Moving it into the same zone makes the traffic free.

Part B. Storage: pay per GB-month

Storage bills on provisioned or stored size multiplied by time. It does not care whether anything ever reads it.

EBS volumes and snapshots

You pay for the size you provision, not the data you store, from the moment the volume is created until it is deleted. Detaching it or stopping the instance changes nothing.

Formula: monthly = provisioned GB × rate + extra IOPS and throughput.

Worked example (hypothetical). Deleting a forgotten 2 TB data volume saves 2,048 × $0.0912 = $187 a month. Sixty unattached volumes totalling 2.3 TB cost about $210 a month while doing nothing.

S3, ECR and AWS Backup

S3 charges separately for what you store, how often you call it, and what you pull back out. The storage class sets the price: cheaper classes trade lower storage cost for retrieval fees and minimum storage durations.

Formula: monthly = GB stored × class rate + requests + retrieval + lifecycle transitions.

Worked example (hypothetical). A single database-backup bucket holding 3.4 TB in Standard costs about $85 a month. A lifecycle rule moving objects older than 30 days to Glacier Flexible Retrieval cuts that part to about $15. Flow-log buckets that already move data to Glacier after 7 days cost almost nothing.

Part C. Per request, per event and per unit

These cost little per call, so they hide until something automated calls them in a loop, or an agent runs every hour.

AWS Cost Explorer

The Cost Explorer console is free. The API (GetCostAndUsage, GetCostForecast, GetRightsizingRecommendation and the rest) costs a flat fee per request, and a paginated response counts one request per page. A separate opt-in charge applies to hourly and resource-level data.

Formula: monthly = calls per day × 30 × $0.01 (multiply by pages per call if results paginate).

CloudWatch: logs, metrics and alarms

Three families. Logs charge per GB ingested (the expensive part), per GB-month stored and per GB scanned by queries. Metrics charge per custom metric per month. Alarms charge per alarm per month. VPC flow logs sent to CloudWatch are "vended logs" and use the vended ingestion tiers.

Formula: logs = GB ingested × $0.67 + GB stored × $0.03 × months kept.

Worked example (hypothetical). 600 GB a month of VPC flow logs sent to CloudWatch costs about $400 in ingestion alone. Keeping 200 GB for 180 days is only about $6 a month of storage, but every byte was already charged $0.67 on the way in. Sending flow logs straight to S3 avoids most of that.

WAF, KMS, Secrets Manager, CloudTrail, Config, Route 53

Security and governance services share one pattern: a small monthly fee per object you create, plus a per-call or per-event fee that scales with traffic or automation.

Formula: monthly = (objects × monthly fee) + (calls or events × unit rate).

RDS, DMS and Directory Service

Managed databases bill the instance by the hour plus storage, backup storage and, for provisioned IOPS, I/O. Multi-AZ doubles both the instance and the storage rate, because AWS runs a standby.

Formula: monthly = (instance rate × 730) + (GB × storage rate) + extra backup.

Worked example (hypothetical). A db.r6g.2xlarge Single-AZ costs $1.025 × 730 = $748 a month. If it sits at 1 percent CPU, dropping two sizes cuts the compute fee by roughly three quarters, because instance cost scales linearly with size.

6. Tax, free tools and governance

7. How to estimate a new component before you build it

1. List every meter in the component's table above: hours, GB, requests, units.
2. For each hourly meter, count the resources and multiply by rate × 730. Count per AZ where the table says per AZ.
3. For each per-GB meter, estimate monthly GB for that path, then multiply. Trace the path: NAT, then firewall, then internet stacks several meters.
4. For storage, multiply provisioned GB by the GB-month rate, and add snapshot and backup copies.
5. Add tax (around 15 to 18 percent in India). Then subtract any Savings Plan coverage, on the compute part only.

Worked example: a new two-AZ VPC with NAT and a firewall, 2 TB a month outbound.

Of that $914, about $666 is fixed and appears before a single byte flows. No compute, load balancers or storage are included yet. This is why "just one more VPC" is rarely cheap.

8. The levers, ranked by how often they pay

1. Delete what exists but is not used. Unattached volumes, idle load balancers, empty clusters, unused VPN tunnels, idle public IPs. Pure hourly savings with no performance risk.
2. Consolidate per-AZ and per-VPC infrastructure. Fewer firewall endpoints, a shared inspection VPC, one ingress per cluster.
3. Fix the traffic path. Gateway endpoints for S3 and DynamoDB, same-AZ placement for chatty services, no NAT where there is no egress need.
4. Right-size, then commit. Resize EC2 and RDS on two weeks of real metrics, move to Graviton, then buy Savings Plans for the steady remainder.
5. Put lifecycles on everything that stores. S3 transitions, noncurrent-version expiry, ECR image limits, snapshot policies, log retention.
6. Watch the loops. Any automation that calls a per-request API on a schedule: Cost Explorer, KMS, Secrets Manager, Config.

9. Common mistakes

• Judging cost by service instead of by meter. You cannot tell rent from tolls at the service level.
• Assuming idle means free. Hourly meters run while idle.
• Buying a Savings Plan before right-sizing. It locks the waste in for one to three years.
• Reading member-account bills when the plan sits at the payer. Compute can look free in a member account.
• Using US prices for Mumbai estimates. Many Mumbai rates are higher, so savings get understated.
• Reading a daily chart with tax in it. The spike on the 1st is tax for the previous month, not a sudden jump in usage.
• Counting "calls per day" without multiplying by accounts and pages. Per-request APIs grow fast in automation.

FAQ

Why does my bill not drop when traffic drops?

Because a large share of it is per-hour rent for things that exist: instances, firewall endpoints, NATs, load balancers and clusters. Those meters run whether or not any traffic flows. Only the per-GB part follows traffic.

Where do NAT and cross-AZ charges show up in Cost Explorer?

Mostly under "EC2 other", not under VPC. Filter by usage type, such as NatGateway-Bytes or DataTransfer-Regional-Bytes, to see them clearly.

Is gp3 always cheaper than gp2?

For the same size, yes: in Mumbai gp3 is $0.0912 per GB-month against $0.114 for gp2, and it includes a higher baseline of IOPS and throughput. You only pay extra on gp3 if you provision IOPS or throughput above the baseline.

Do Savings Plans cover the firewall or data transfer?

No. They cover compute only (EC2, and for Compute Savings Plans also Fargate and Lambda). Firewalls, NAT, EBS and data transfer stay at their normal rates.

Is the Cost Explorer API expensive?

Each call is one cent, which is cheap until automation runs it in a loop across many accounts and pages. A design that calls once from the payer account and caches the result stays cheap.

Glossary

Takeaways

• Every AWS line item is one of seven meters. Learn the meter and you know the lever.
• Close to half of a networking-heavy bill can be hourly rent that runs while idle.
• The path a GB takes decides how many per-GB meters it pays.
• Storage bills on provisioned size and time, never on use.
• Per-request services are cheap until automation loops them.
• Resize first, then commit, and judge commitments at the payer account.

References

• AWS Price List API Where every rate in this guide comes from.
• AWS Network Firewall pricing Endpoint-hours and GB processed.
• Amazon VPC pricing NAT, public IPv4, endpoints, Transit Gateway and VPN.
• Elastic Load Balancing pricing LCU and NLCU dimensions.
• Amazon EC2 on-demand pricing Instance rates and data transfer.
• Amazon EBS pricing gp3, gp2, io2 and snapshots.
• Amazon S3 pricing Storage classes, requests and transitions.
• Amazon CloudWatch pricing Logs, vended logs, metrics and alarms.
• AWS Cost Explorer pricing API requests and granular data.
• Savings Plans pricing Compute and EC2 Instance plans.
• Amazon EKS pricing Standard and extended support.
• Amazon RDS for PostgreSQL pricing Single-AZ and Multi-AZ.