DataTransfer-Out-BytesAmazon EC2Internet data transfer out
A per-gigabyte charge for data that leaves an AWS region for the public internet.
$0.09 per GB (first 10 TB/month tier). us-east-1, applies after the AWS-wide free tier; as of 2026-07
Reference
The AWS Bill Decoder
Every cryptic line item on an AWS bill, decoded: what it means, why it spikes, and how to cut it. Each one is verified against official AWS documentation, not guessed.
Last updated 50 line items across 7 categories
Where to find these on your own bill
- Open Cost Explorer and set "Group by" to Usage type. Do not stop at Service. This page decodes the Usage type field.
- For detail that Cost Explorer's UI does not show, turn on a Cost and Usage Report (CUR). Read the lineItem/UsageType column. It holds the identical string.
- If the list is long, filter to one service first. Then group by Usage type to see which charge drives that service's cost.
- Don't recognize a code on your own bill? Paste it into CostMon's search (⌘K) or the filter below. Most of what appears on real AWS bills is covered here.
- Want this decoded against your actual numbers instead of one code at a time? Drop your own Cost Explorer CSV into the AWS Bill Analyzer. It finds the line items on this page in your bill automatically and deep-links straight back here.
How to read a usage type
Most of the confusion in a usage-type string comes from a small, consistent grammar. It has a region code, an optional inter-region pair, a direction, and sometimes an instance-type suffix.
(no prefix)Generally us-east-1 (N. Virginia) is the default region for the classic "AWS Data Transfer" family (DataTransfer-Out-Bytes, DataTransfer-Regional-Bytes). Every other region gets its short code prepended instead. This rule has exceptions. Some services (Elastic Load Balancing, Transit Gateway, Public IPv4) also prefix us-east-1 as USE1-. Check which service a code belongs to before you assume.
USE1 / USE2us-east-1 (N. Virginia) / us-east-2 (Ohio)
USW1 / USW2us-west-1 (N. California) / us-west-2 (Oregon)
EU / EUW2 / EUW3eu-west-1 (Ireland, note the bare "EU", no trailing "1") / eu-west-2 (London) / eu-west-3 (Paris)
EUC1 / EUN1eu-central-1 (Frankfurt) / eu-north-1 (Stockholm)
APN1 / APN2 / APN3ap-northeast-1 (Tokyo) / ap-northeast-2 (Seoul) / ap-northeast-3 (Osaka)
APS1 / APS2 / APS3ap-southeast-1 (Singapore) / ap-southeast-2 (Sydney) / ap-south-1 (Mumbai)
USE1-USW2- (a paired prefix)An inter-region transfer between the two named regions: the first is the source, the second is the destination. Only the source region's outbound leg is billed; the destination's inbound leg is $0.
-AWS-Out-Bytes / -AWS-In-BytesOutbound (billed) vs. inbound (free) data transfer between AWS regions, or between AWS and the public internet.
:instanceType suffixThe specific instance type or size a charge applies to, e.g. BoxUsage:m5.large. One line per distinct type in use.
Worked example
USE1-USW2-AWS-Out-BytesUSE1: the source region, us-east-1USW2: the destination region, us-west-2AWS: the transfer stayed inside AWS's network. It did not use the public internet.Out: this is the outbound, billed leg. It starts on the source region's side.Bytes: AWS meters it per byte (GB). It does not meter per hour or per request.
This exact line only appears on the us-east-1 side of the transfer. The us-west-2 side shows the free companion line, USW2-USE1-AWS-In-Bytes, for the same traffic.
Filter line items
The line items that surprise teams most
Data transfer & networking
The single biggest mystery bucket on most bills: internet egress, cross-AZ, NAT gateways, and the region-code grammar behind all of it.
USE1-USW2-AWS-Out-BytesAmazon EC2Inter-region data transfer
A charge for data sent from one AWS region (here, us-east-1) to a different AWS region (here, us-west-2).
DataTransfer-Regional-BytesAmazon EC2Cross-AZ (regional) data transfer
A charge for data that moves between Availability Zones in the same AWS region. AWS bills both the sending side and the receiving side.
$0.01 per GB, in each direction. us-east-1; billed as two separate $0.01/GB charges (in + out) for each transfer; as of 2026-07
NatGateway-BytesAmazon VPCNAT gateway data processing
A per-gigabyte charge for every byte that passes through your NAT gateway. It adds to the flat hourly uptime charge. It also adds to any standard data-transfer charge that the traffic would incur anyway.
$0.045 per GB processed. us-east-1; separate from the flat $0.045/hour NAT gateway uptime charge and from any standard data-transfer charge on the same bytes; as of 2026-07
PublicIPv4:InUseAddressAmazon VPCPublic IPv4 address charge
An hourly charge for every public IPv4 address you hold. The charge applies if the address serves traffic. It also applies if the address is allocated but idle.
$0.005 per hour per address. us-east-1 (uniform across commercial AWS regions); identical whether the address is in-use or idle; as of 2026-07
VpcEndpoint-BytesAmazon VPCVPC interface endpoint (PrivateLink)
An hourly fee per endpoint per Availability Zone, plus a per-gigabyte fee for data processed through an interface VPC endpoint (AWS PrivateLink).
TransitGateway-BytesAWS Transit GatewayTransit Gateway attachment and data processing
An hourly fee for each attachment (VPC, VPN, Direct Connect, peering) on your Transit Gateway, plus a per-gigabyte fee for data processed through it.
LoadBalancerUsageElastic Load BalancingLoad balancer hourly usage and LCU charge
An hourly rate per load balancer, plus a rate per Load Balancer Capacity Unit (LCU) used. The highest dimension in that hour sets the LCUs. The dimensions are new connections, active connections, processed bytes, and rule evaluations. The LCU count is not a simple sum.
US-DataTransfer-Out-BytesAmazon CloudFrontCloudFront data transfer and requests
A per-gigabyte charge for content that CloudFront serves from its edge locations to end users, plus a per-10,000-requests charge. Rates depend on the edge-location group (US, EU, AP, and so on) that served the request.
Compute
EC2, Fargate, EKS, and Lambda: what you pay for per hour, per GB, and per invocation.
BoxUsage:m5.largeAmazon EC2On-Demand instance hours
The hourly running time of an On-Demand EC2 instance of the given type, in the given region. This is the base compute rate before other EC2 charges (storage, data transfer) are added.
SpotUsage:m5.largeAmazon EC2Spot instance hours
The hourly running time of an EC2 Spot Instance of the given type. AWS bills it at the Spot market price, which changes, instead of the fixed On-Demand rate.
HeavyUsage:m5.largeAmazon EC2Reserved Instance recurring fee
The recurring charge for a Reserved Instance you've already committed to. It's billed whether or not a matching instance is running that hour.
UnusedBox:m5.largeAmazon EC2Unused Capacity Reservation
The instance-hours of an On-Demand Capacity Reservation that were held open but never had an instance launched into them. These bill at the full On-Demand rate for empty, reserved slots.
DedicatedUsage:m5.largeAmazon EC2Dedicated Instance hours
The hourly running cost of an EC2 instance launched with dedicated tenancy. This is single-tenant physical hardware. AWS bills it at a premium over the same instance type's shared-tenancy rate. A flat per-region hourly fee also applies if any dedicated instance runs in that region.
Fargate-vCPU-Hours:perCPUAWS FargateFargate vCPU and memory hours
The vCPU-hours and the companion memory GB-hours requested by your container tasks, billed per second from task start to stop. It's metered by resource request, not by underlying node.
AmazonEKS-Hours:perClusterAmazon EKSEKS cluster control-plane fee
A flat hourly fee charged per EKS cluster for the managed Kubernetes control plane, independent of how many nodes or pods run underneath it.
Lambda-GB-SecondAWS LambdaLambda compute duration (GB-seconds)
The memory-allocated × duration charge for Lambda execution. AWS meters it in GB-seconds from invocation (including cold start) to return. The x86 line and the cheaper Graviton/ARM line (Lambda-GB-Second-ARM) tier and bill independently.
Storage
EBS volumes and snapshots, S3's storage classes and request tiers, and the early-delete penalty nobody reads the fine print on.
EBS:VolumeUsage.gp2Amazon EBSEBS General Purpose SSD storage (gp2/gp3)
Billing for the provisioned capacity (GB-month) of General Purpose SSD EBS volumes. The types are gp2 and its newer, usually cheaper sibling, gp3.
EBS:VolumeP-IOPS.piopsAmazon EBSEBS Provisioned IOPS charge (io1/io2)
A separate per-IOPS-month charge for the performance you provisioned on io1/io2 volumes, billed apart from the volume's GB-month storage charge.
EBS:SnapshotUsageAmazon EBSEBS snapshot storage
GB-month charge for EBS snapshots in the Standard tier, billed incrementally on the changed blocks each snapshot stores.
TimedStorage-ByteHrsAmazon S3S3 Standard storage
The core "you store data, you pay for it" charge. It covers GB-months of object data and metadata held in S3 Standard storage. AWS meters it hourly and averages it over the month.
TimedStorage-SIA-ByteHrsAmazon S3S3 Standard-Infrequent Access storage
GB-month storage charge for objects held in the S3 Standard-IA class. It's cheaper per-GB than Standard, but with per-GB retrieval fees and a 30-day minimum storage duration per object.
TimedStorage-GlacierByteHrsAmazon S3S3 Glacier Flexible Retrieval storage
GB-month storage charge for archived objects held in the S3 Glacier Flexible Retrieval class, AWS's low-cost long-term archive tier.
Requests-Tier1Amazon S3S3 request charges (PUT/COPY/POST/LIST and GET)
Per-request API charges, billed per thousand requests. Tier1 covers PUT, COPY, POST, and LIST calls. A separate Tier2 line covers GET and most other read requests.
EarlyDelete-ByteHrsAmazon S3S3 Glacier early-deletion charge
A prorated penalty for an object in S3 Glacier Flexible Retrieval that you delete, overwrite, or transition before its 90-day minimum storage commitment ends. The Instant Retrieval and Deep Archive classes have parallel early-delete charges.
Databases
RDS, Aurora, DynamoDB, and ElastiCache: instance hours, storage I/O, and the Multi-AZ charge that doubles a bill.
InstanceUsage:db.m5.largeAmazon RDSRDS instance hours
The hourly on-demand compute charge for a single-AZ RDS database instance of a given class, billed from launch until the instance is stopped or deleted.
Multi-AZUsage:db.m5.largeAmazon RDSRDS Multi-AZ instance hours
The hourly compute charge for a Multi-AZ RDS deployment. It bills the primary instance and its synchronous standby replica in another Availability Zone.
RDS:GP3-StorageAmazon RDSRDS gp3 storage
The per-GB-month charge for General Purpose SSD (gp3) storage provisioned on a single-AZ RDS instance, separate from the instance-hour and IOPS/throughput charges.
RDS:ChargedBackupUsageAmazon RDSRDS backup storage overage
The per-GB-month charge for RDS automated backups and manual snapshots. It starts when their combined size exceeds the free allotment (up to 100% of total provisioned database storage).
Aurora:ServerlessV2UsageAmazon AuroraAurora Serverless v2 ACU usage
The per-second (billed hourly) charge for Aurora Capacity Units (ACUs) that an Aurora Serverless v2 instance uses. Each ACU is roughly 2 GiB of memory plus matching CPU and networking.
Aurora:StorageIOUsageAmazon AuroraAurora I/O requests
The per-operation charge for read and write I/O requests against Aurora's distributed storage layer, under the default storage configuration.
WriteCapacityUnit-HrsAmazon DynamoDBDynamoDB provisioned write capacity
The hourly charge for provisioned write capacity units reserved on a DynamoDB table, billed whether or not the capacity is consumed.
NodeUsage:cache.m5.largeAmazon ElastiCacheElastiCache node hours
The hourly on-demand charge per provisioned ElastiCache node of a given instance class. Billing runs from launch until you terminate the node. Partial hours round up to a full hour.
Observability & management
CloudWatch, Config, and CloudTrail: the tools you turned on to control cost that can themselves become a line item.
DataProcessing-BytesAmazonCloudWatchCloudWatch Logs ingestion
Charges for every byte of log data your applications, agents, or functions push into CloudWatch Logs.
$0.50 per GB ingested (Standard log class). us-east-1, as of 2026-07
VendedLog-BytesAmazonCloudWatchCloudWatch vended logs
The per-GB charge for logs that other AWS services generate and deliver into CloudWatch Logs for you. Examples are VPC flow logs, DNS query logs, CDN logs, and WAF logs. AWS bills them apart from logs your own code writes.
CW:MetricMonitorUsageAmazonCloudWatchCloudWatch custom metrics
The per-metric-per-month charge for every unique custom metric (and dimension combination) published to CloudWatch. The source can be your own application, embedded metric format logs, or detailed instance monitoring.
$0.30 per metric per month (first 10,000 custom metrics). us-east-1, as of 2026-07
CW:AlarmMonitorUsageAmazonCloudWatchCloudWatch alarms
The per-alarm hourly charge (prorated to per-month) for every standard-resolution metric alarm that exists in your account, whether or not it has ever fired.
CW:RequestsAmazonCloudWatchCloudWatch API requests
The per-1,000-request charge for CloudWatch API calls beyond the free tier (most visibly reads of metric data), billed once you exceed the free allotment.
ConfigurationItemRecordedAWS ConfigAWS Config configuration item recording
The per-item charge AWS Config bills every time it detects and records a change to a tracked resource's configuration. It's metered by how often your infrastructure changes, not a flat monthly fee.
PaidEventsRecordedAWS CloudTrailCloudTrail data events
A per-100,000-events charge for CloudTrail data events. These are fine-grained, resource-level API activity, such as object reads or function invocations. The charge starts once you turn on data-event logging for a trail. CloudTrail logs management events free by default.
Security & keys
KMS, Secrets Manager, and GuardDuty: small per-unit charges that add up fast at scale.
KMS-KeysAWS Key Management ServiceKMS customer-managed key, monthly fee
A flat monthly charge (prorated hourly) for every customer-managed key you've created in KMS, whether or not it's ever used to encrypt anything.
KMS-RequestsAWS Key Management ServiceKMS API request charge beyond the free tier
Billing for KMS API calls (encrypt, decrypt, generate-data-key, and similar) once you exceed the monthly free-tier request allotment.
AWSSecretsManager-SecretsAWS Secrets ManagerSecrets Manager per-secret storage fee
A flat monthly charge (prorated hourly) for every secret stored in Secrets Manager, including each cross-region replica, regardless of how often it's used.
AWSSecretsManagerAPIRequestAWS Secrets ManagerSecrets Manager API request charge
Billing for API calls to Secrets Manager (retrieving, describing, writing, and listing secrets) at a small per-10,000-requests rate; every operation counts, not just retrievals.
PaidEventsAnalyzed-BytesAmazon GuardDutyGuardDuty log analysis, per GB
GuardDuty's charge for the volume (in GB) of network flow and DNS query log data it analyzes each month. A tiered per-GB schedule applies after any free-trial allowance.
AI & ML
Bedrock tokens and SageMaker instance-hours, plus the AI spend that never touches an AWS bill at all.
USE1-Claude4.6Sonnet-input-tokensAmazon BedrockBedrock input tokens (per model)
Every token sent into a Bedrock model as part of the prompt is metered. This includes system instructions, chat history, retrieved context, and few-shot examples. AWS bills input tokens per model, apart from output tokens.
USE1-Claude4.6Sonnet-output-tokensAmazon BedrockBedrock output tokens (per model)
Tokens the model generates in its response are billed as a separate line item from input tokens, usually at a materially higher per-token rate.
USE1-Claude4.6Sonnet-cache-read-input-token-countAmazon BedrockBedrock prompt-cache read tokens
Tokens that Bedrock serves from its prompt cache appear as their own usage type. Bedrock does not reprocess them as full input. AWS bills them at a steep discount against a normal input token.
USE1-Host:ml.g5.xlargeAmazon SageMakerSageMaker real-time endpoint hours
Billed for every hour a SageMaker real-time inference endpoint's instance is running, regardless of whether it's actively serving prediction traffic.
USE1-Notebk:ml.g4dn.8xlargeAmazon SageMakerSageMaker notebook instance hours
Billed for every hour a classic SageMaker notebook instance sits in an active state, independent of whether anyone is actively working in it.
AI spend that never touches an AWS bill is easy to miss. A direct Anthropic API subscription is one case. An OpenAI API key billed to a corporate card is another. A third-party AI vendor invoice is a third. None of them appears in Cost Explorer or a Cost and Usage Report. This is true however closely you watch every line item above. A team can be disciplined about every Bedrock token and still get blindsided by spend building up entirely outside AWS. So AI cost visibility must cover every model provider a team uses. Do not limit it to the one that bills through the AWS account. See LLM API pricing, the AI agent cost guide, and AI/LLM cost monitoring.
No line items match that filter. Try a different word, or search everything on CostMon instead.
FAQ
Common questions about reading an AWS bill
Where do I see AWS usage types on my bill?
In the AWS Cost Explorer console, set "Group by" to Usage type instead of just Service. That's the field this page decodes. For row-by-row detail that Cost Explorer's UI does not show, turn on a Cost and Usage Report (CUR). Read the lineItem/UsageType column. It holds the identical string.
Why does the same usage type show up with a different prefix in different accounts?
Usage types are region-scoped. A code with no region prefix generally means us-east-1 for the classic data-transfer family. Every other region gets its short code (USE2, USW2, EUC1, APS1, and so on) prepended. Some services (Elastic Load Balancing, Transit Gateway, Public IPv4) prefix us-east-1 explicitly too, so the "no prefix = us-east-1" rule isn't universal across every service.
What's the difference between a usage type and an operation?
Usage type is the billing meter: the dimension AWS charges you on, like NatGateway-Bytes or BoxUsage:m5.large. Operation (lineItem/Operation in a CUR) is the specific API call that triggered it, like RunInstances or GetObject. Several operations can roll up into the same usage type. More than one operation can also trigger the same usage type. So a filter on usage type alone is sometimes too broad to find the root cause.
Why is my NAT gateway bill so much higher than I expected?
A NAT gateway bills in three separate ways. First, a flat hourly uptime charge. Second, a per-GB data-processing charge for every byte that passes through it. Third, the standard data-transfer charge that the same traffic would incur anyway. Traffic that could reach an AWS service through a VPC endpoint is the most common avoidable driver. Gateway endpoints have no per-GB processing fee.
Is data transfer into AWS free?
Generally yes. Data transfer from the public internet into an AWS region costs $0. The inbound leg of a transfer between two AWS regions also costs $0. Only the sending side (internet egress out of a region, or the outbound leg of an inter-region transfer) carries a charge. Cross-AZ (regional) transfer is the one common exception, billed on both the sending and receiving side.
Why did I get billed for a public IP address I'm not even using?
AWS began charging for every public IPv4 address on February 1, 2024, not just "extra" or idle Elastic IPs, as before. An unattached Elastic IP left over from a decommissioned instance bills at the same hourly rate as one that serves traffic. Idle allocations are pure waste. Release them.
Does CostMon replace reading my AWS bill line by line?
That's the point of it. CostMon pulls these same usage-type-level records automatically. It normalizes them next to your other cloud and AI spend. It alerts you early, before a spike such as an unattached Elastic IP or a runaway CloudWatch Logs group reaches the invoice. That means you don't have to reverse-engineer usage types by hand every month.
A bill read by hand goes stale tomorrow.
Reading one export line by line takes real work. CostMon reads the next one for you, every day, for every provider you connect.