What Hybrid Cloud Networking Actually Costs

Most hybrid cloud decisions are made on compute and storage prices. The network bill between the two sides shows up later, once workloads are split and data starts moving back and forth. In a hybrid setup between AWS and a private cloud, every byte that crosses between them is billed on one side or the other, and which side depends on the direction it travels. Get the layout right and cross-cloud traffic is a small line item. Get it wrong and it can erase a good part of what you saved by moving.

Here’s a pattern that causes trouble. A team moves its application servers to a private cloud to cut compute costs, but leaves the database in AWS because it’s the harder piece to move. Every query the application runs now sends its results out of AWS and across the internet or a VPN to the private cloud. The application works fine. But the database’s responses, which used to stay inside one AWS region, now leave AWS, and data leaving AWS is billed per GB.

Nothing about that layout is wrong in principle. It just needs to be priced before it’s built. This article walks through where the charges come from and how to design around them.

Where Hybrid Traffic Gets Billed

Traffic between AWS and a private cloud touches three kinds of charges: what AWS bills for data leaving AWS, what your private cloud provider bills for data leaving the private cloud, and charges inside AWS that hybrid traffic can trigger along the way.

Traffic Leaving AWS

AWS bills data transfer out to the internet per GB. The rates are listed in the data transfer section of the Amazon EC2 on-demand pricing page, with tiers based on your aggregate usage across EC2, S3, RDS, and a long list of other services. AWS includes 100 GB of free data transfer out to the internet each month, aggregated across services and regions.

Data coming into EC2 from the internet is not charged. So traffic from your private cloud into AWS is free on the AWS side, while traffic from AWS to your private cloud is billed per GB.

A VPN doesn’t change that math. AWS Site-to-Site VPN pricing includes an hourly fee for each connection while it’s active, and data transfer out over the VPN is charged at the same data transfer out rates from the EC2 pricing page. The VPN encrypts the traffic. It doesn’t make it cheaper.

Traffic Leaving Your Private Cloud

On OpenMetal, the model is different. Each server includes a public egress allocation at no extra cost, and on a cluster those allocations combine across all the servers. Usage beyond the included allocation is billed at $375 per Gbps using 95th percentile measurement rather than per GB. Inbound traffic isn’t charged. Our article on why your egress bill is higher than your bandwidth usage explains how 95th percentile billing works in detail.

Traffic between your own servers on OpenMetal’s private networks isn’t billed at all. Each server has 20 Gbps of private bandwidth by default, and that internal traffic is unmetered.

Charges Inside AWS That Hybrid Traffic Can Trigger

Two AWS charges are easy to miss when you price a hybrid layout:

• NAT gateways. Resources in private subnets often reach the outside world through a NAT gateway. Amazon VPC pricing shows NAT gateways bill an hourly rate plus a per-GB data processing charge, and standard data transfer charges still apply on top. Traffic that passes through a NAT gateway on its way out of AWS pays twice: once for processing and once for leaving.
• Traffic between Availability Zones. Within AWS, data moving between Availability Zones in the same region is charged per GB in each direction, as listed on the same EC2 pricing page. If the AWS side of your hybrid setup spans zones, traffic headed for your private cloud may cross a zone boundary before it ever leaves AWS.

Direction Matters More Than Volume

Put those pieces together and a pattern shows up. The same amount of data can cost very different amounts depending on which way it flows.

• From AWS to your private cloud: billed per GB by AWS as data transfer out, plus any NAT processing on the way out.
• From your private cloud to AWS: draws on your OpenMetal egress allocation, with overage measured by 95th percentile. Not charged by AWS on arrival.
• Within your private cloud: unmetered.

So the question to ask about every cross-cloud flow is “how much data, in which direction, and through what path?” A layout that sends large responses out of AWS will cost more than one that sends the same volume the other way.

A Simple Way to Estimate Cross-Cloud Costs

Rates vary by region and change over time, so we won’t quote AWS prices here. Pull current numbers from the AWS pricing pages linked above and plug them into this model.

For each flow between AWS and your private cloud, list:

1. Direction: AWS to private cloud, or private cloud to AWS
2. Monthly volume: in GB
3. Path: direct over the internet, through a VPN, or through a NAT gateway

Then estimate the AWS side:

• AWS data transfer out = (GB per month from AWS to private cloud) × (AWS data transfer out rate)
• NAT processing = (GB per month passing through NAT gateways) × (NAT data processing rate), plus the hourly gateway charge
• VPN connection = (hours per month) × (VPN connection rate), if you use one

And the private cloud side:

• OpenMetal egress = nothing extra if your 95th percentile outbound rate stays within your cluster’s included allocation, or $375 per Gbps of 95th percentile usage above it

Applying It to the Example Above

Take the team that moved its application servers and left the database in AWS. Say the database returns 20 TB of query results a month to the application.

• That’s 20,000 GB of AWS data transfer out every month, multiplied by your region’s rate.
• If the database sits in a private subnet behind a NAT gateway, add 20,000 GB of NAT processing.
• If the connection runs over AWS Site-to-Site VPN, add the hourly connection fee.

Now move the database to the private cloud alongside the application. Those 20 TB of query results travel over the private network and aren’t billed at all. The only cross-cloud traffic left is whatever still needs to talk to AWS, and much of it may now flow in the direction AWS doesn’t charge for.

Same workload, same data, very different network bill. The difference is entirely in where the chatty pieces sit.

Design Patterns That Keep Hybrid Traffic Cheap

Keep Chatty Tiers on the Same Side

A costly mistake is splitting components that talk constantly. An application and its database, a service and its cache, a processing job and its input data: these should usually live on the same side of the hybrid boundary. Split along lines where traffic is light, such as between independent services or between a workload and an occasional reporting job.

Move Data With the Compute That Reads It

If a workload moves to the private cloud, the data it reads most often should move with it. Leaving a large dataset in S3 and reading it from the private cloud means paying data transfer out on every read. Moving the dataset once costs less than reading it across the boundary over and over.

When you do plan a full move off a service, check AWS’s policy. The EC2 pricing page notes that AWS offers eligible customers free data transfer out to the internet when they move all of their data off AWS, or all of their data off a particular AWS service.

Send Results, Not Raw Data

When a process has to run on one side and report to the other, send the processed result rather than the raw input. Aggregate, filter, and compress before data crosses the boundary. A summary of a dataset is usually a tiny fraction of its size.

Cache What Crosses Repeatedly

If the same data crosses the boundary again and again, such as reference data, configuration, or frequently read objects, keep a copy on the side that reads it. A cache refreshed occasionally is cheaper than a live read every time.

Keep AWS-Internal Traffic Off the NAT Gateway

Within AWS, data transferred directly between EC2 and S3 or certain other AWS services in the same region isn’t charged for data transfer. When that same traffic is routed through a NAT gateway, the NAT processing charge applies. Cleaning this up doesn’t change your hybrid flows, but it keeps the AWS side of a hybrid setup from carrying charges it doesn’t need.

Plan Addressing Before You Connect

Overlapping IP ranges between your AWS VPCs and your private cloud networks make routing between them harder, and fixing addressing after the fact is disruptive. Plan both sides’ ranges together before you set up the connection.

Where the Network Fits in a Placement Decision

Cross-cloud traffic is one input to a bigger question: which workloads belong on which side. A workload that looks cheaper on private infrastructure on compute alone can look different once you add the traffic it would send across the boundary. And a workload that seemed hard to justify moving can look better once you see how much cross-cloud traffic moving it would eliminate.

That’s the kind of analysis OpenMetal Labs does. Labs works from your actual public cloud spend to identify which workloads would cost less on private infrastructure and which should stay where they are, so placement decisions account for more than the compute line.

Who This Is For

This is most relevant if you:

• Are planning to move some workloads off AWS while keeping others there
• Already run hybrid and see data transfer out growing on your AWS bill
• Run data-heavy services where large reads or replication cross between environments
• Use NAT gateways or VPN connections between AWS and another environment

It matters less if you:

• Are moving a workload and its data together, with little traffic back to AWS afterward
• Run workloads that are mostly independent, with light traffic between environments
• Send most cross-cloud traffic from your private cloud into AWS, which AWS doesn’t charge for on arrival

The Short Version

In hybrid cloud, the network bill depends on direction and layout as much as volume. Keep the chatty pieces together, move data with the compute that reads it, and price every flow that crosses the boundary before you build it.

If you’re working out which workloads to move and how to lay out the connection, talk with our team or learn how OpenMetal Labs approaches placement decisions. You can also size the private cloud side with our private cloud pricing calculator.

Frequently Asked Questions

Does AWS charge for data sent from a private cloud into AWS?

Data transfer into EC2 from the internet isn’t charged. Traffic from your private cloud into AWS is generally free on the AWS side, while traffic from AWS to your private cloud is billed as data transfer out.

Does a VPN reduce AWS data transfer costs?

No. AWS Site-to-Site VPN adds an hourly connection fee, and data transfer out over the VPN is charged at the standard EC2 data transfer out rates.

How does OpenMetal bill egress?

Each server includes a public egress allocation, and allocations combine across a cluster. Usage above the included amount is billed at $375 per Gbps using 95th percentile measurement. Inbound traffic and traffic on your private networks aren’t billed.

Why does a NAT gateway increase hybrid costs?

NAT gateways charge an hourly rate plus a per-GB processing fee, and standard data transfer charges apply on top. Traffic that leaves AWS through a NAT gateway pays both the processing fee and data transfer out.

What’s the most effective way to cut cross-cloud traffic costs?

Keep components that talk constantly, such as an application and its database, on the same side of the hybrid boundary. Splitting chatty tiers is one of the most expensive layout mistakes in hybrid setups.

Does AWS charge to move data out when leaving entirely?

AWS states on its EC2 pricing page that it offers eligible customers free data transfer out to the internet when they move all of their data off AWS or off a particular AWS service. Check the eligibility terms before planning around it.