An AWS Site-to-Site VPN connection costs $0.05 an hour in US East (Ohio), which is $36.00 a month. That is the number people quote, and in AWS's own first pricing example it is 6.87% of the bill. The traffic crossing the tunnel is billed as data transfer out to the internet, at internet egress rates, and that line is $451.80. A Site-to-Site VPN on a Transit Gateway is metered three separate ways, and AWS's pricing examples show only two of them.
How much does an AWS Site-to-Site VPN connection cost per month?
$36.00, before a single packet moves. The AWS VPN pricing page states the meter plainly: "you are charged for each VPN connection-hour that your VPN connection is provisioned and available. Each partial VPN connection-hour consumed is billed as a full hour." Its first example puts a rate on it: "For the US East (Ohio) Region, the fee is $0.05 per hour. You pay $36.00 per month in connection fees." Every example on that page uses a 30-day, 24-hour month, so 720 hours is AWS's convention and the one used below.
| Meter, US East (Ohio), from AWS's worked examples | Rate | Month at 720 hours |
|---|---|---|
| Site-to-Site VPN connection-hour (1.25 Gbps) | $0.05 | $36.00 |
| Site-to-Site VPN connection-hour (5 Gbps) | $0.60 | $432.00 |
| Transit Gateway attachment-hour | $0.05 | $36.00 |
| Transit Gateway data processing | $0.02 per GB | $20.48 per TB |
| Data transfer out, first 10 TB | $0.09 per GB | $92.16 per TB |
| Site-to-Site VPN Concentrator-hour | $1.95 | $1,404.00 |
| Site behind a Concentrator | $0.01 | $7.20 |
| In-use public IPv4 address | $0.005 | $3.60 |
Is AWS Site-to-Site VPN free, or is there a free tier?
No. Nothing on the VPN pricing page grants free connection-hours, and the charge runs on provisioning rather than on traffic, so a tunnel that never carries a byte still bills $36.00 a month. The one free element near a VPN bill is not a VPN allowance at all: the EC2 On-Demand pricing page says "AWS customers receive 100 GB of free data transfer out to the internet free each month, aggregated across all AWS Services and Regions (except China and GovCloud)." All six VPN examples deduct 100 GB before charging egress, which reads as a per-connection allowance and is not one. If CloudFront and S3 have already eaten it, the VPN gets none. The tiers above it are in how AWS charges for data transfer out.
Logging is free at the VPN end only: "There are no additional Site-to-Site VPN service-specific charges for enabling Site-to-Site VPN logs", after which CloudWatch bills ingestion and retention at the rates in what CloudWatch Logs actually cost.
Why is data transfer out the larger half of a Site-to-Site VPN bill?
Because the connection charge is flat and the traffic charge is not. The pricing page routes VPN egress to the general internet rate: "Data transfer out on AWS Site-to-Site VPN incurs data transfer out charges that are explained in the EC2 on-demand pricing page". Example 1 prices it at "$0.09 per GB", the first-10-TB internet tier, not a discounted private rate. The crossover is 500 GB a month: $36.00 buys 400 billable gigabytes, and the free 100 GB sits on top. Above it the connection fee stops mattering. Hypothetical volumes at AWS's US East (Ohio) rates, on a virtual private gateway so no Transit Gateway charges are in play:
| Egress per month | Connection-hours | Data transfer out | Total | Egress share |
|---|---|---|---|---|
| 100 GB | $36.00 | $0.00 | $36.00 | 0.0% |
| 500 GB | $36.00 | $36.00 | $72.00 | 50.0% |
| 1 TB | $36.00 | $83.16 | $119.16 | 69.8% |
| 5 TB | $36.00 | $451.80 | $487.80 | 92.6% |
| 10 TB | $36.00 | $912.60 | $948.60 | 96.2% |
| 20 TB | $36.00 | $1,783.00 | $1,819.00 | 98.0% |
Direction matters as much as volume. Example 1 moves "10 TB in and transfer 5 TB out" and charges only the outbound half: "you pay for 5020 GB (5 TB = 5120 GB) at $0.09 per GB. You pay $451.80 per month in data transfer out fees." Twice as much went the other way and produced no line at all. A VPN pulling backups into AWS bills almost nothing; the same tunnel serving a datacentre from AWS bills like a public website.
How is a Site-to-Site VPN on a Transit Gateway metered three times?
Attach the VPN to a Transit Gateway and the same tunnel acquires two more meters. The VPN charge is not absorbed: "AWS Site-to-Site VPN connection pricing still applies in addition to AWS Transit Gateway VPN attachment pricing." On top of it sits the hourly meter, "For AWS VPN attachments, the Transit Gateway owner is billed hourly", and the per-gigabyte one: "Data processing charges apply for each gigabyte sent from a VPC, Direct Connect or VPN or Network Firewall to the AWS Transit Gateway", priced in that page's own example at "a charge of $0.02". The stack on one hypothetical 1.25 Gbps connection carrying 1 TB each way:
| Meter on a single VPN tunnel | Basis | Month |
|---|---|---|
| Site-to-Site VPN connection-hour | $0.05 x 720 | $36.00 |
| Transit Gateway attachment-hour | $0.05 x 720 | $36.00 |
| Transit Gateway data processing, inbound leg | 1,024 GB x $0.02 | $20.48 |
| Transit Gateway data processing, outbound leg | 1,024 GB x $0.02 | $20.48 |
| Data transfer out to the internet | 924 GB billable at $0.09 | $83.16 |
| Two in-use public IPv4 addresses | 2 x $0.005 x 720 | $7.20 |
| Total | $203.32 |
The connection-hour everybody quotes is 17.7% of that. The omission is the interesting part: all six worked examples on the VPN pricing page sit on a Transit Gateway, and not one includes the Transit Gateway data processing charge. Each bills the attachment-hour and stops. Apply the Transit Gateway page's own rule to example 1 and the inbound leg is 10,240 GB at $0.02, or $204.80, and the outbound leg is 5,120 GB, or $102.40. That is $307.20 a month missing from a bill AWS totals at "You pay $523.80 per month for AWS Site-to-Site VPN 1.25 Gbps connection", a 58.6% understatement, and 39.1% on the inbound leg alone. Which account pays which Transit Gateway meter is in Transit Gateway pricing and costs.
Price the missing line yourself from the
VPN metrics reference:
TunnelDataIn and TunnelDataOut, summed for a month
by the VpnId dimension. Both are floors. AWS notes of
TunnelDataIn that "This metric counts the data after
decryption", and no AWS page says whether the transfer charge is computed on
plaintext or on the encrypted packet. An idle tunnel is not silent either:
"These metrics can report network usage even when the tunnel is down."
Does AWS charge for both Site-to-Site VPN tunnels?
Not as connection-hours. The Site-to-Site VPN user guide states "Each VPN connection includes two VPN tunnels which you can simultaneously use for high availability", and the AWS VPN FAQ puts both inside one connection: "Each AWS Site-to-Site VPN connection has two tunnels and each tunnel supports a maximum throughput of up to 1.25 Gbps." One connection, one $0.05. Buying a second connection on a virtual private gateway buys resilience and not bandwidth, because "Multiple VPN connections to the same Virtual Private Gateway are bound by an aggregate throughput limit from AWS to on-premises of up to 1.25 Gbps". On a Transit Gateway the Site-to-Site VPN quotas page says "you can use ECMP to get higher VPN bandwidth by aggregating multiple VPN tunnels", and each added connection carries its own two hourly meters.
The public IPv4 charge is where the pages stop agreeing. The VPN pricing page is singular: "Each Site-to-Site VPN connection uses unique public IPv4 address for the tunnels." The VPC pricing page is plural: "public IPv4 addresses assigned to AWS Global Accelerator and AWS Site-to-Site VPN tunnel endpoints are charged as in-use public IPv4 address." At the $0.005 hourly rate, one endpoint or two is $3.60 or $7.20 a month. Budget for two and check; how public IPv4 addresses are charged covers finding them.
What does accelerated Site-to-Site VPN cost on top?
Two accelerator fees and a per-gigabyte premium. The accelerated VPN documentation gives the shape: "we create and manage two accelerators on your behalf, one for each VPN tunnel." The pricing page turns that into money: "You will also incur hourly charges for two Global Accelerators per VPN connection and Data Transfer Out Premium (DT-Premium) fees." At the Global Accelerator pricing page's "you are charged $0.025 until it is deleted", two accelerators are $36.00 a month, matching the connection.
DT-Premium reprices traffic nobody was billing you for. It lands on the dominant direction, not the outbound one: "You will only be charged DT-Premium in the dominant data transfer direction", and AWS's accelerated example lands on the inbound half. "The fee for VPN Data Transfer Premium is decided by the larger direction of data transfer, in this case 10 TB of data transferred in." That is $153.60 a month levied on 10 TB the unaccelerated version of the same connection carried for nothing. Acceleration turns the free direction into a billable one, and it stacks: "The DT-Premium fee is in addition to normal EC2 Data Transfer Out fees". Across examples 1 and 2 it adds $189.60 to a $523.80 bill, 36.2%.
The rate turns on which edge location traffic lands at: $0.015 per GB from a United States and Canada source to a European edge, the rate AWS's example uses, and $0.105 per GB to an Australia and New Zealand edge. The same 10 TB hypothetically terminating in Sydney would be $1,075.20 a month, 29.9 times the connection charge. And it is not reversible: "You cannot turn on or turn off acceleration for an existing Site-to-Site VPN connection."
Is a 5 Gbps Site-to-Site VPN cheaper than four 1.25 Gbps connections?
No, and AWS's examples 3 and 4 prove it without drawing the conclusion. Both carry identical traffic to identical capacity. The single connection, at "$0.60/hr per 5 Gbps Site-to-Site VPN connection per hour", ends at "You pay $4862.20 per month for high bandwidth with AWS Site-to-Site VPN 5 Gbps connection." Four standard connections bound together end at "You pay $4682.20 per month for high bandwidth with AWS Site-to-Site VPN 1.25 Gbps connection."
$180.00 a month apart, $2,160.00 a year, in favour of the bundle. The fixed side is $468.00 for the 5 Gbps connection plus its attachment against $288.00 for four connections plus four attachments: $93.60 against $57.60 per Gbps. Twelve standard connection-hours cost what one 5 Gbps connection-hour costs, and only four are needed to reach 5 Gbps. The premium buys one tunnel pair instead of four and no ECMP to configure.
Before trusting those totals to the cent: the examples do not use the same arithmetic. Example 3 says "For the first 10TB, you pay at $0.09 per GB. For the next 40TB, you pay at $0.085 per GB", which read literally gives $4,394.70; its printed figure is $4,394.20, what you get by taking the free 100 GB out of the $0.09 tier. Example 5 does the opposite, stating "For the first 10,240 GB, you pay at $0.09 per GB. For the remaining 14,660 GB, you pay at $0.085 per GB", charging the whole first tier instead. Both totals are internally consistent, and the two methods differ by $0.50 on one page.
When does an AWS Site-to-Site VPN Concentrator pay for itself?
At 23 sites. AWS publishes only the 50-site case, so the break-even is computed here from its rates. A Concentrator is "$1.95/hr per Site-to-Site VPN Concentrator per hour" plus "$0.01/hr per Site-to-Site VPN connections per hour for sites connected via VPN Concentrator", and it needs one Transit Gateway attachment for the fleet rather than one per site: $1,440.00 fixed and $7.20 per site, against $72.00 per site for a connection and its own attachment. Each site saves $64.80, so $1,440.00 divided by $64.80 is 22.22 sites and the Concentrator wins from the 23rd.
| Remote sites | Concentrator, fixed charges | One connection per site | Difference |
|---|---|---|---|
| 20 | $1,584.00 | $1,440.00 | -$144.00 |
| 22 | $1,598.40 | $1,584.00 | -$14.40 |
| 23 | $1,605.60 | $1,656.00 | +$50.40 |
| 50 | $1,800.00 | $3,600.00 | +$1,800.00 |
| 100 | $2,160.00 | $7,200.00 | +$5,040.00 |
That 50-site row reproduces the gap between AWS's examples 5 and 6 exactly, data transfer excluded because it is identical in both. The two are not interchangeable, though, and the quotas page is where that shows: it caps a Concentrator tunnel at 100 Mbps against 1.25 Gbps for a standard tunnel. The $1,800 a month saving at 50 sites is a saving on connections one twelfth the speed. For branch offices that is the right trade. For a datacentre it is not, and the alternative is usually AWS Direct Connect pricing, which charges port-hours and a lower per-GB outbound rate.
How does AWS Client VPN pricing differ from Site-to-Site VPN?
Different product, different meters, and the two get confused constantly. AWS Client VPN connects individual users rather than networks, and bills "the number of active client connections per hour and the number of subnets that are associated to Client VPN per hour". Its example gives both rates, "$0.10 per hour in AWS Client VPN endpoint hourly fees" for one subnet and $0.05 for each client connection-hour.
| Question | Site-to-Site VPN | Client VPN |
|---|---|---|
| Hourly meter | $0.05 per connection | $0.10 per subnet association |
| Second meter | none | $0.05 per active client connection-hour |
| Fixed month, minimum | $36.00 | $72.00 for one subnet |
| Tunnels included | two, one charge | one per client, each charged |
| Egress | data transfer out to the internet | data transfer out to the internet |
The association fee catches people because capacity is tied to it. The Client VPN quotas page scales concurrent client connections with the number of associations, from 7,000 on one to 126,000 on five, so headroom for 126,000 clients costs $360.00 a month before a single user connects. A hypothetical 100 users online 8 hours a day for 22 days is 17,600 connection-hours, $880.00, or $1,024.00 a month on two associations. One always-on client connection costs $36.00, the same as an entire Site-to-Site VPN connection serving an office.
Client VPN inherits the public IPv4 charge too: "Client VPN endpoints require Elastic IP addresses when associated with a VPC subnet that has an Internet Gateway". If that subnet reaches the internet through a managed gateway instead, the per-GB processing charge in what a NAT Gateway costs applies to the same bytes.