S3 egress is the line item most engineering teams don't see until it's catastrophic. Here are the 6 patterns that cut S3 egress bills 70% — exact, audited, real.
Lakshmi Kiranmai Guduru
Founder, CARTIEAI
S3 egress audits we've run, blunt math, no fluff. Specific dollar figures are from real customer accounts; you should expect 50–80% of your egress to be eliminable on first pass.
Three things make S3 egress especially treacherous:
We've seen one single mis-routed Glue job balloon a customer's monthly egress bill by $40K in 11 days. The patterns below would have caught it on day 1.
Default behaviour: an EC2 instance in a private subnet talking to S3 routes through a NAT Gateway → through internet → back to S3. You pay:
With a VPC Gateway Endpoint (free!) for S3, traffic stays on AWS internal networking. Cost: $0.00/GB.
The audit move:
aws ec2 describe-vpc-endpoints \
--filters Name=service-name,Values="com.amazonaws.<region>.s3" \
--query 'VpcEndpoints[*].VpcId'
Cross-reference against your VPC list. Any VPC that talks to S3 and isn't in this list is bleeding money on every byte.
Real example. A data company ran ETL jobs in a private subnet pulling 8 TB/month from S3. Cost via NAT: ~$1,080/month. Cost with Gateway Endpoint: $0. Saved $13K/year, took 11 minutes to deploy.
Estimated savings: 90–100% on S3-from-VPC traffic.
Direct S3 to internet: $0.09/GB. CloudFront to internet: $0.085/GB and you get caching, which means your origin (S3) reads drop 60–95% on real workloads.
Net effect: a static site or media-asset bucket served via CloudFront usually costs 20–40% less than direct S3 — even ignoring the caching benefit. With caching, it's often 70–90% less.
The audit move: look for any S3 bucket with public-read policies and a HEAD/GET-heavy access pattern. If it's serving directly to the internet, you're paying double.
Bonus: CloudFront's Origin Shield (extra layer, ~$0.01/GB) further reduces origin reads when you have many edge locations. Worth it for high-traffic sites.
Estimated savings: 30–80% on public S3 egress.
S3 in us-east-1 to compute in us-east-2? $0.02/GB cross-region. Compute and S3 in the same region? $0.00/GB.
The audit:
aws s3api list-buckets --query 'Buckets[*].[Name,CreationDate]'
aws s3api get-bucket-location --bucket <name>
For each compute cluster, list the S3 buckets it talks to. Any cross-region pairing is a candidate for migration or replication. CRR (Cross-Region Replication) moves data once and lets your compute hit a same-region copy from then on.
Estimated savings: 100% on cross-region egress; pay back the CRR cost within 1–6 months on heavy workloads.
Egress and storage interact in counter-intuitive ways:
Most teams default everything to Standard "to be safe". For data accessed less than monthly, Intelligent-Tiering's automatic transitions cut storage cost 80–90% with no operational overhead — and unlike Glacier classes, no retrieval fees to surprise you.
The audit move: S3 Storage Class Analytics → identify objects with last-access > 30 days → switch tier or apply a Lifecycle Rule.
Estimated savings: 40–80% on storage cost. Read patterns matter — model before switching.
The catastrophic-egress patterns we see:
Mitigation:
s3:GetObject from outside expected principalsBytesDownloaded > 2× rolling-7-day baselineEstimated savings: Your sanity, primarily. Catastrophe-prevention math doesn't have a clean ROI but the worst case is 5- and 6-figure single-month bills.
Every audit finds at least one bucket of uncompressed JSON or CSV being shipped at full size to clients. gzip, zstd or brotli compresses log/JSON payloads 60–95%. CloudFront does this automatically for some content types when Compress Objects Automatically is on; check that it's enabled in your distributions.
Estimated savings: Linear with compression ratio. 60–80% on text/JSON-heavy egress.
Do these in order:
aws ce get-cost-and-usage scoped to S3 + DataTransfer for the last 30 days, broken down by usage type.BytesDownloaded and BytesDownloadedExternal per bucket.That's it. We've never run this audit on a real account and found <$500/month of egress savings.
CARTIEAI's S3 egress analyzer connects read-only to your AWS account, models egress per bucket / per VPC / per region, and surfaces the 5 highest-ROI moves with their dollar impact. Typical first scan: $1K–$25K/month of quick wins.
Even without a tool, Patterns 1 and 2 alone find 50–80% savings on most accounts.
Now go run describe-vpc-endpoints. 🧭
THE FINOPS BRIEF
Built for finance & engineering teams who are tired of paying for cloud they don't use. No fluff. Just what works.
Unsubscribe anytime. We never sell your data.
ABOUT THE AUTHOR
Founder, CARTIEAI · Building in public
I'm building CARTIEAI to fix the cloud-cost problem I saw drain millions at companies I worked for — where engineering and finance kept talking past each other. If you liked this post, here's where I share unfiltered notes on building this in public: