Task Statement 4.4: Design cost-optimized network architectures.

📘AWS Certified Solutions Architect – (SAA-C03)

1. Core Idea (Very Important for Exam)

In AWS, network cost is mainly based on traffic movement, not just infrastructure.

You must design routes that:

Keep traffic inside AWS private networks when possible
Avoid unnecessary cross-region or internet routing
Reduce use of NAT Gateways and public internet
Choose services that reduce data transfer charges and improve performance

2. AWS Network Cost Areas You MUST Know

A. Region-to-Region Data Transfer

When data moves:

From one AWS Region → another AWS Region

Key points:

This is expensive
Always consider whether cross-region traffic is truly needed
Costs increase with:
- Replication
- Backup sync
- Multi-region applications

Exam best practice:

Use region-to-region transfer only when required for:

Disaster recovery
Global applications
Data sovereignty requirements

Optimization strategies:

Use single-region architecture when possible
Use content delivery caching (CloudFront)
Replicate only necessary data (not full traffic)

B. Availability Zone (AZ) to AZ Data Transfer

Inside a region:

Each region has multiple AZs
Data transfer between AZs = charged separately

Key points:

Cheaper than inter-region
But still not free
Often overlooked in exams

Common exam scenario:

If a service sends traffic:

EC2 in AZ-A → EC2 in AZ-B → cost increases

Optimization strategies:

Keep tightly coupled systems in the same AZ when possible
Use load balancers properly distributed
Avoid unnecessary cross-AZ chatter for high-volume systems

C. Private vs Public Network Routing

This is VERY IMPORTANT for cost optimization.

1. Public Internet Routing

Traffic goes through:

Internet Gateway
Public IPs

2. Private Routing

Traffic stays inside:

AWS private backbone network

Cost problem area: NAT Gateway

If private EC2 needs internet access:

It routes through NAT Gateway
NAT Gateway charges:
- hourly cost + data processing cost

Optimization:

Reduce NAT usage
Replace with VPC Endpoints

3. VPC Endpoints (VERY HIGH EXAM TOPIC)

From Amazon VPC and VPC Endpoints

What it does:

Allows private resources (like EC2) to access AWS services without using internet or NAT Gateway

Types of VPC Endpoints:

1. Gateway Endpoint

Used for:

Amazon S3
DynamoDB

✔ Free (no hourly cost)
✔ Highly cost-efficient
✔ Traffic stays on AWS backbone

2. Interface Endpoint (PrivateLink)

Used for:

Most AWS services (e.g., SQS, SNS, Secrets Manager)

✔ Reduces NAT Gateway usage
✔ Private ENIs used inside VPC
❌ Has hourly + data cost

Exam takeaway:

If you see:

“Reduce NAT Gateway cost”

👉 Answer = Use VPC Endpoints

4. AWS Global Accelerator

From AWS Global Accelerator

What it does:

Routes user traffic through the AWS global edge network instead of the public internet

Key benefits:

1. Better routing performance

Finds fastest path to backend
Reduces internet hops

2. Static IP addresses

Useful for global applications

3. Failover support

Automatically reroutes traffic to healthy regions

Important exam clarification:

Does it reduce data transfer cost?

❌ Not directly

What it DOES improve:

✔ Performance
✔ Availability
✔ Reliability

When to use:

Global users accessing multi-region app
Need fast failover between regions
Reduce internet unpredictability

5. Region-to-Region vs Global Accelerator (Exam Trap)

Feature	Region-to-Region Routing	Global Accelerator
Cost	Expensive data transfer	Does not reduce transfer cost
Path	Direct region links	AWS backbone + edge
Use case	Data replication	User traffic optimization
Focus	Data movement	Performance

6. Private to Public Routing Optimization

This is where most cost problems occur.

Bad design:

EC2 in private subnet
Uses NAT Gateway for everything (S3, APIs, updates)

Good design:

Replace NAT traffic using:

✔ VPC Endpoints

S3 access without internet
AWS service calls stay private

✔ AWS backbone routing

Avoid internet gateway usage

7. Key Exam Decision Rules (VERY IMPORTANT)

Rule 1:

If question says:

“Reduce NAT Gateway cost”

✔ Answer: Use VPC Endpoints

Rule 2:

If question says:

“Reduce inter-AZ cost”

✔ Keep compute + database in same AZ if possible

Rule 3:

If question says:

“Reduce inter-region traffic cost”

✔ Minimize cross-region replication
✔ Use caching (CloudFront)
✔ Avoid unnecessary sync

Rule 4:

If question says:

“Improve global user performance”

✔ Use AWS Global Accelerator

Rule 5:

If question says:

“Private access to AWS services without internet”

✔ Use VPC Endpoints

8. Summary (Exam Revision)

To design cost-optimized AWS network routes:

Minimize expensive traffic:

Region-to-region transfers
Cross-AZ communication
NAT Gateway usage

Use AWS-native optimizations:

Amazon VPC for network design
VPC Endpoints to avoid NAT and internet
AWS Global Accelerator for global performance routing