Cloud egress: AWS Cost Explorer data-transfer line decoder
Cost Explorer and CUR-style views often label Data Transfer–Out to Internet, InterZone / cross-AZ, NAT Gateway, CloudFront, S3, and S3 Cross-Region Replication / inter-region replication as separate lines. This FinOps-lite decoder maps each label to a PipeToll path template, checklist spoke, and Mode A/B/C deep-link — rates stay Unknown until verified.
Updated
Turn opaque AWS data-transfer lines into named path templates before any $/GB arithmetic — educational only, not a quote.
Dated official starting points only — Unknown until verified means no invented $/GB. Label wording varies by account, service filter, and CUR version; always confirm on your console.
FinOps readers often export Cost Explorer by Usage type or CUR lineItem/UsageType strings and still paste one blended “AWS egress” rate. PipeToll keeps each label on its own path template before Mode A/B/C arithmetic. Educational FinOps-lite only — not a broker quote.
How to read the decoder (understanding)
Export 30–90 days of Cost Explorer (or CUR) filtered to data-transfer / networking usage types.
Match each major label to a row in the matrix above — do not merge InterZone with Internet DT-out.
Re-run after architecture changes (endpoints, CDN, multi-AZ NAT) — literacy is continuous.
Common traps
“Data Transfer” as one SKU — CE/CUR labels collapse Internet, InterZone, ELB, NAT, DX, and CRR into lookalike strings. Map each talker to its own path template before pricing.
NAT hours ignored because Internet GB appear — NAT Gateway hours + processing sit beside Internet DT-out in the triple-charge stack. Open NAT vs IGW / Mode B.
CloudFront edge confused with origin fill — Edge DT-out and miss-driven origin fill are different meters. Pair Mode C with CDN origin fill.
Transfer Acceleration = Internet DT-out — S3 Transfer Acceleration is its own SKU — sibling TA vs Internet; do not paste into the Internet cell.
Savings crowns from a decoder map — This page maps labels to templates only. Rates stay Unknown until verified; PipeToll never guarantees savings.
FinOps checklist
Label every material talker: Internet, InterZone, NAT, CloudFront/origin, S3 GET, S3 CRR / inter-region replication, ELB cross-zone/LCU-adjacent, peering, TGW, PrivateLink/interface endpoints, Direct Connect.
Attach this decoder URL plus the matching spoke in your runbook.
NAT Gateway Hours — 730 h + NAT Bytes Processed — 1,100 GB → Mode B triple-charge with Internet DT-out already counted above; rates Unknown.
CloudFront Data Transfer Out — 5,000 GB + miss-driven origin fill estimate → Mode C; rates Unknown.
S3 Data Transfer Out — 800 GB (non-accelerated) → Mode A · path=s3-direct; rate Unknown.
Worked stack (synthetic) — all $/GB and $/hour Unknown until verified
#
Line
Volume
Unit rate
Mode
1
Internet DT-out
2,400 GB
Unknown $/GB
A
2
InterZone
600 GB
Unknown $/GB
A
3
NAT hours + processing
730 h · 1,100 GB
Unknown
B
4
CloudFront edge (+ origin fill)
5,000 GB edge
Unknown
C
5
S3 Internet GET
800 GB
Unknown $/GB
A
Synthetic educational arithmetic only — not a quote and not a savings guarantee.
Worked-estimate sensitivity (educational)
Hold the five-line CE stack (2.4 TB Internet · 0.6 TB InterZone · NAT · CloudFront · S3 GET) and walk three decoder runs. Every $/GB and $/hour stays Unknown — this is label literacy, not a bill quote.
Run B — CDN twin: CloudFront edge 5 TB + miss-driven origin fill — Mode C / CDN origin fill. Keep edge off the Internet DT-out cell.
Run C — Acceleration sibling: if S3 Transfer Acceleration appears, open TA vs Internet instead of pasting into Internet DT-out; S3 non-accelerated GET stays its own Mode A line.
Usually Internet data-transfer-out toward public clients. Start with the path checklist and free-tier cliff, then Mode A — keep $/GB Unknown until verified.
Is InterZone the same as Internet egress?
No. Inter-AZ / InterZone-style lines are usually regional cross-zone meters. Use cross-AZ vs cross-region and a separate Mode A run.
Where do NAT Gateway lines belong?
NAT Gateway hours and processing are part of the triple-charge stack with Internet DT-out. Open NAT vs IGW and Mode B.
Does this decoder invent $/GB?
No. PipeToll maps labels to path templates only. Rates stay Unknown until a human cites a dated official AWS page — see methodology. Use the worked-estimate sensitivity runs to keep Internet, InterZone, NAT, CloudFront, and Transfer Acceleration on separate Mode A/B/C lines — never invent a blended $/GB from Incomplete cells.
Where do ELB cross-zone, peering, TGW, and PrivateLink lines belong?
ELB cross-zone / LCU-adjacent, VPC peering DT, TGW attachment+processing, and PrivateLink interface meters each get their own path template — see ELB cross-zone, peering vs TGW, and PrivateLink vs NAT egress. Never blend with Internet DT-out.
Where do multi-cloud Blob / R2 / Azure bandwidth lines go?
Trademarks: Amazon Web Services, AWS, Microsoft Azure, Google Cloud Platform, GCP, and Cloudflare are trademarks of their respective owners. PipeToll (Ameti One LLC) is not affiliated with, endorsed by, or sponsored by those companies. Educational comparisons may be outdated — verify current rates with each provider.
