Review Transit Gateway and inter-AZ transfer costs

Why this is worth a look

AWS assigns hourly attachment charges by type: the VPC owner pays for a VPC attachment, while VPN, Direct Connect, Connect, peering, and network function attachments have different documented owners. Transit Gateway processing applies to each gigabyte sent from specified attachments into the gateway, with a peering exception. CloudWatch BytesIn and BytesOut are traffic metrics, not invoice lines, and VPC attachments also support attachment-plus-Availability Zone dimensions.

Run in each Transit Gateway Region. Replace REGION, TRANSIT_GATEWAY_ID, TRANSIT_GATEWAY_ATTACHMENT_ID, --start-time, and --end-time with your scope and the same UTC boundaries used for the billing analysis.

# Inventory attachments visible for one Transit Gateway
aws ec2 describe-transit-gateway-attachments \
  --region REGION \
  --filters Name=transit-gateway-id,Values=TRANSIT_GATEWAY_ID \
  --query 'TransitGatewayAttachments[].{Attachment:TransitGatewayAttachmentId,Type:ResourceType,Resource:ResourceId,ResourceOwner:ResourceOwnerId,TransitGatewayOwner:TransitGatewayOwnerId,State:State,Created:CreationTime}' \
  --output table \
  --no-cli-pager

# Read attachment traffic for the billing-analysis UTC window
aws cloudwatch get-metric-data \
  --region REGION \
  --start-time 2026-08-01T00:00:00Z \
  --end-time 2026-09-01T00:00:00Z \
  --metric-data-queries '[{"Id":"bytes_in","MetricStat":{"Metric":{"Namespace":"AWS/TransitGateway","MetricName":"BytesIn","Dimensions":[{"Name":"TransitGatewayAttachment","Value":"TRANSIT_GATEWAY_ATTACHMENT_ID"}]},"Period":3600,"Stat":"Sum"}},{"Id":"bytes_out","MetricStat":{"Metric":{"Namespace":"AWS/TransitGateway","MetricName":"BytesOut","Dimensions":[{"Name":"TransitGatewayAttachment","Value":"TRANSIT_GATEWAY_ATTACHMENT_ID"}]},"Period":3600,"Stat":"Sum"}}]' \
  --output json \
  --no-cli-pager

How to confirm it

1. 01

   Set the review scope

   Replace REGION, both resource IDs, and the start and end timestamps before running the commands. Use UTC boundaries matching the billing analysis. Run the commands in each Region containing the Transit Gateway.

2. 02

   Map visible attachment ownership

   Use the attachment output to record resource type, resource owner, Transit Gateway owner, state, and creation time. Reconcile current or still-visible attachments to billing using AWS ownership rules for VPC, VPN, Direct Connect, Connect, peering, and network function attachments.

3. 03

   Handle deleted attachments separately

   The describe command returns the current result set and creation time, not a deletion timestamp or a complete historical timeline. For billed periods containing deleted attachments, use separately retained account records to establish their existence and deletion window before comparing hourly lines.

4. 04

   Attribute traffic and transfer

   Read BytesIn with Sum as the signal for bytes received by the Transit Gateway from an attachment, and BytesOut with Sum as the signal for bytes sent to it. For VPC attachments, use the attachment-plus-Availability Zone dimensions to investigate enabled AZs, then apply the pricing rule for the exact path. Do not count both boundaries as two processing events for one flow.

5. 05

   Review peering paths

   For inter-Region peering, identify the source gateway and sending account. AWS does not charge processing for bytes sent from a peering attachment into a Transit Gateway, while standard inter-Region data transfer can still apply. Keep those transfer lines separate from processing.

Primary sources