Amazon Bedrock bills for model inference by token count. That is the pricing AWS surfaces in the console and the number developers budget against. It is not the full picture. In high-volume production deployments, network and data-transfer charges — NAT Gateway processing fees, cross-AZ transfer, VPC endpoint overhead, load balancer LCU billing, CRIS routing — routinely add 20–35% on top of inference cost. At multi-TB/month scale they can exceed the inference line item entirely.
This note maps every network charge layer that Bedrock workloads generate, with cost formulas, architecture comparison tables, and CUR query patterns for surfacing them.
1. Bedrock API Response Egress: Is Inference Output Billed as Data Transfer?
The basic rule
Bedrock itself does not charge a separate per-GB fee for API responses. Inference is priced in tokens. The response payload — JSON envelope plus generated text — is not metered as “data transfer out of Bedrock” on the Bedrock service line item.
However, the network path the response travels may incur standard AWS data transfer charges depending on where the calling application runs:
| Caller location | Response path | Data transfer charge |
|---|---|---|
| EC2/ECS/Lambda in same region, same VPC, via VPC endpoint | Private AWS backbone | None (VPC endpoint data processing: $0.01/GB) |
| EC2/ECS in same region, NAT Gateway to public Bedrock endpoint | NAT processing + internet egress | $0.045/GB (NAT) + $0.09/GB (egress) = $0.135/GB |
| Lambda in same region, public internet | Internet egress | $0.09/GB after 1 GB/month free |
| Cross-region request (app in us-east-1, model in us-west-2) | AWS inter-region transfer | $0.02/GB |
| On-premises caller via public internet | Internet egress | $0.09/GB (first 10 TB/month) |
The critical insight: if your application pods route outbound traffic through a NAT Gateway to reach the public Bedrock endpoint, every byte of the response payload is processed twice — once through NAT (inbound to NAT, outbound to your VPC) — and NAT charges $0.045/GB for all data processed in either direction.
Payload size estimation
Output tokens convert to bytes at roughly 3–4 bytes per token (BPE tokenization with UTF-8 text). A 1,000-token response ≈ 3.5 KB of text, plus ~500 bytes of JSON envelope. At 1 million Bedrock calls per day generating 500 output tokens each:
Daily output payload ≈ 1,000,000 × (500 tokens × 3.5 bytes + 500 bytes JSON) = ~2 GB/day = ~60 GB/month
At 60 GB/month through a NAT Gateway: $8.10/month NAT processing + $5.40/month egress = $13.50/month — trivial at this scale. At 10× (600 GB/month), that becomes $135/month; at 100× (6 TB/month), $1,350/month. The NAT Gateway portion ($0.045/GB) is the key variable to eliminate.
2. VPC Endpoint (PrivateLink) for Bedrock
What endpoints exist
As of February 2026, Bedrock supports the following Interface VPC endpoints:
| Service name | Purpose |
|---|---|
com.amazonaws.<region>.bedrock |
Control-plane (model metadata, policy) |
com.amazonaws.<region>.bedrock-runtime |
Inference (InvokeModel, InvokeModelWithResponseStream) |
com.amazonaws.<region>.bedrock-agent |
Agents control-plane |
com.amazonaws.<region>.bedrock-agent-runtime |
Agents runtime (RetrieveAndGenerate) |
com.amazonaws.<region>.bedrock-mantle |
OpenAI-compatible endpoint (added Feb 2026) |
For Knowledge Bases, the S3 data source uses an S3 Gateway endpoint — no PrivateLink required, no cost.
Pricing structure
Interface endpoint pricing has two components:
- Hourly ENI charge: $0.01/hour per AZ × number of endpoints
- Data processing: $0.01/GB for all traffic through the endpoint
A minimal production setup (bedrock + bedrock-runtime, 2 AZs):
2 endpoints × 2 AZs × $0.01/hour × 730 hours = $29.20/month (ENI only)
Data processing: $0.01/GB × volume
A full Bedrock + Knowledge Bases + Agents deployment (5–6 endpoints, 3 AZs):
~5 endpoints × 3 AZs × $0.01/hour × 730 = $109.50/month (ENI only)
VPC endpoint vs NAT Gateway cost crossover
The savings from eliminating NAT Gateway depend on traffic volume. For the NAT path:
- NAT data processing: $0.045/GB
- Internet egress (if applicable): $0.09/GB
- NAT hourly: $0.045/hour/AZ
For the VPC endpoint path:
- Endpoint data processing: $0.01/GB
- Endpoint hourly: ~$0.01/hour/AZ × number of endpoints
Breakeven formula (3 AZ, 2 endpoints vs 3 NAT Gateways):
NAT monthly fixed: 3 × $0.045 × 730 = $98.55
Endpoint monthly fixed: 2 × 3 × $0.01 × 730 = $43.80
NAT per-GB rate: $0.045
Endpoint per-GB rate: $0.010
Fixed cost premium to switch to endpoints: $43.80 - $98.55 = endpoint is already cheaper on fixed cost
Per-GB savings: $0.035/GB (not counting the $0.09/GB egress also eliminated)
At any positive traffic volume, VPC endpoints are cheaper than NAT Gateways for Bedrock traffic when the existing NAT Gateways carry Bedrock-significant loads. The only scenario where NAT wins: you already have NAT Gateways for other traffic and Bedrock volume is under ~10 GB/month (endpoint ENI fixed cost not recovered).
When PrivateLink is worth it
| Scenario | Recommendation |
|---|---|
| Production workload, >50 GB/month Bedrock traffic | PrivateLink — pays for itself, adds security boundary |
| Compliance requirement (HIPAA, FedRAMP, financial data) | PrivateLink mandatory — traffic never traverses public internet |
| Dev/test, <10 GB/month | Public endpoint via NAT; endpoint ENI cost not justified |
| Already have NAT for other services, Bedrock is minor | Keep NAT; do not add endpoint overhead |
| Bedrock-only VPC (dedicated AI tier) | PrivateLink — no NAT needed at all |
3. Cross-AZ Data Transfer for Bedrock Workloads
The hidden $0.02/GB charge
AWS charges $0.01/GB in each direction for data crossing AZ boundaries within a region. For Bedrock workloads, this surfaces in one specific pattern: application pods in AZ-b routing traffic through a NAT Gateway located in AZ-a.
Data path: App (AZ-b) → cross-AZ → NAT GW (AZ-a) → public internet → Bedrock endpoint
Charges per GB:
Cross-AZ outbound: $0.01
NAT processing: $0.045
Internet egress: $0.09
Return path cross-AZ: $0.01 (response coming back through NAT to app in different AZ)
─────────────────────────────
Total: $0.145/GB
Compare to same-AZ NAT or VPC endpoint:
- Same-AZ NAT path: $0.135/GB (no cross-AZ)
- VPC endpoint (same-AZ ENI): $0.01/GB (data processing only)
Fix: one NAT Gateway per AZ
EKS and ECS clusters often provision a single NAT Gateway and route all AZs through it to save the hourly NAT cost ($0.045/hour × 3 AZs = $99/month vs $33/month). At low traffic volume, this is rational. At high Bedrock volume:
Cross-AZ premium: $0.02/GB × 2 AZs routing through foreign NAT × volume
At 1 TB/month: $0.02 × 2 × 1,000 = $40/month cross-AZ overhead
At 5 TB/month: $200/month in pure cross-AZ charges
The crossover where deploying NAT Gateways in all three AZs pays back: roughly 330 GB/month per AZ pair being penalized. Above that, add the NAT Gateways.
4. NAT Gateway Cost at High Token Volume
Cost structure stacking
NAT Gateway charges accumulate in three layers that most teams only partially account for:
| Charge type | Rate | Notes |
|---|---|---|
| Hourly per NAT GW | $0.045/hour ($32.40/month) | Per AZ, always on |
| Data processing | $0.045/GB | Bidirectional — both request and response counted |
| Internet egress | $0.09/GB | On response data leaving AWS (if caller is on-prem/internet) |
| Cross-AZ | $0.01/GB each direction | Only if AZ mismatch, see Section 3 |
The data processing charge is bidirectional. A 1 MB Bedrock request + 500 KB response = 1.5 MB processed = $0.0000675 per call. At 10 million calls/day: $675/day = $20,250/month in NAT processing alone — before egress charges or hourly fees.
Concrete scenario: chatbot at scale
Assume a production RAG chatbot:
- 500K user turns/day
- Average: 2,000 input tokens (context + retrieval), 400 output tokens
- Input payload: ~7 KB, output payload: ~1.5 KB, total per call: ~8.5 KB
- Daily throughput: 500K × 8.5 KB = 4.25 GB/day = ~130 GB/month
NAT processing: 130 GB × $0.045 = $5.85/month
NAT hourly (3 AZ): 3 × $32.40 = $97.20/month
Internet egress: 130 GB × $0.09 = $11.70/month (if external callers)
─────────────────────────────────────────────────
Monthly NAT cost: $114.75/month
VPC endpoint alternative:
Endpoint data processing: 130 GB × $0.01 = $1.30/month
Endpoint ENI (2 eps, 3 AZs): $43.80/month
Total: $45.10/month
Monthly savings from endpoints: $69.65/month
At 10× this volume (5M turns/day, ~1.3 TB/month), NAT cost reaches ~$750/month while VPC endpoint cost reaches ~$57/month — a $693/month or ~$8,300/year delta.
5. Knowledge Base Data Transfer Costs
S3 ingestion pipeline
Bedrock Knowledge Bases sync documents from S3, chunk and embed them, and write vectors to a vector store. The data transfer implications:
| Step | Transfer type | Cost |
|---|---|---|
| S3 to Bedrock ingestion job (same region) | Intra-AWS, same region | Free (no egress charge) |
| Bedrock calling embedding model (e.g., Titan Embeddings) | Internal service call | Charged as token usage, no network fee |
| Bedrock writing embeddings to OpenSearch Serverless | Same-region intra-AWS | Free |
| Bedrock writing embeddings to Amazon S3 Vectors (GA Dec 2025) | Same-region intra-AWS | Free |
| Bedrock writing embeddings to Aurora PostgreSQL (pgvector) | Same-region intra-AWS | Free |
S3 ingestion data transfer is free as long as S3 and Bedrock are in the same region. There is no cross-service “intra-region” charge for moving source documents from S3 into the Bedrock ingestion pipeline.
Exception: if you use a self-managed OpenSearch cluster in a different VPC without VPC peering or PrivateLink, vector writes route through a NAT Gateway and incur processing charges.
RAG query path transfer
On each query, Bedrock Knowledge Bases:
- Embeds the query (token charge, no network fee)
- Queries the vector store (intra-region, no egress)
- Fetches source chunks from S3 (intra-region — use S3 Gateway endpoint to avoid NAT)
- Sends context + query to the inference model (token charge)
- Returns response to caller
The S3 Gateway endpoint is the critical free optimization here. Without it, S3 chunk retrieval routes through NAT, adding $0.045/GB processing on every RAG context fetch. S3 Gateway endpoints are free, have no hourly charge, and require only a route table entry.
Vector store query response sizes
For RAG retrieval, typical response sizes:
- OpenSearch Serverless: returns top-K chunks as JSON; at K=5 with 500-char chunks ≈ 3–5 KB per query
- S3 Vectors: similar retrieval payload
- Aurora pgvector: smaller protocol overhead
At 500K RAG queries/day with 4 KB average retrieval payload:
- 500K × 4 KB = 2 GB/day retrieval data ≈ 60 GB/month
- Without S3 Gateway endpoint: 60 GB × $0.045 = $2.70/month NAT processing (low, but avoidable)
- With S3 Gateway endpoint: $0
6. Load Balancer Proxy: ALB vs NLB vs API Gateway
When teams deploy LiteLLM, an OpenAI-compatible proxy, or a custom routing layer in front of Bedrock, the choice of load balancer affects both feature availability and data transfer billing.
Cost comparison
| Component | ALB | NLB | API Gateway (HTTP API) |
|---|---|---|---|
| Fixed cost | $0.008/LCU-hour (~$16/month base) | $0.006/NLCU-hour (~$12/month base) | $1.00/million requests |
| Data processed | ~$0.008/LCU (included in LCU calc) | $0.006/NLCU | $1.00/million + $0.09/GB data transfer |
| Cross-AZ transfer | $0.01/GB when cross-zone enabled | $0.01/GB when cross-zone enabled | N/A (managed) |
| Streaming support | HTTP/2 chunked | TCP passthrough | Yes (HTTP API) |
| Typical monthly (100K req/day) | $20–40 | $15–30 | $3–8 |
| Typical monthly (5M req/day) | $120–250 | $80–180 | $150–400 |
Recommendation matrix
| Use case | Recommendation | Rationale |
|---|---|---|
| LiteLLM proxy with auth, routing, retries | ALB | Layer 7 routing, health checks, WAF integration |
| Pure TCP proxy, lowest latency | NLB | Lower LCU cost, no L7 overhead |
| Low-volume, serverless, no infra ops | API Gateway HTTP API | No infra; per-request billing favors bursty low-volume |
| High-volume streaming (>1M req/day) | ALB or NLB | API Gateway becomes expensive; $1/million × 1M/day = $30/month + egress |
| API Gateway at 10M req/day | Avoid | $300/month requests + data transfer — NLB at $80–120 is cheaper |
API Gateway data transfer trap: API Gateway charges standard AWS data transfer rates ($0.09/GB) on responses to the internet, stacked on top of the per-request fee. For Bedrock workloads where response payloads are substantive (LLM output), this can double the effective per-GB cost compared to ALB or NLB with a VPC endpoint backend.
7. CloudFront for LiteLLM Proxy: Net Cost Impact
The free origin transfer rule
Data transfer from AWS origins (EC2, ALB, API Gateway) to CloudFront edge locations is free — no egress charge between origin and CloudFront. CloudFront then charges for delivery to end users at CDN rates, which are lower than raw AWS internet egress:
| Volume | CloudFront delivery | Raw internet egress |
|---|---|---|
| First 10 TB/month | $0.0085/GB (US/EU) | $0.09/GB |
| 10–50 TB | $0.0080/GB | $0.085/GB |
| 100–450 TB | $0.0060/GB | $0.07/GB |
CloudFront delivery is ~90% cheaper than direct internet egress for the same data. However, CloudFront adds its own charges:
- HTTPS request fee: $0.0100/10,000 requests
- Origin Shield (optional): $0.0100–$0.0150/10,000 requests
Does CloudFront make sense for a LiteLLM/Bedrock proxy?
CloudFront is a caching CDN. LLM inference responses are not cacheable — every prompt generates a unique response. Therefore:
- CloudFront cannot cache Bedrock responses; every request is a cache miss and passes through to origin
- CloudFront’s cost advantage (lower per-GB delivery) applies, but you pay for request fees on every pass-through
- Streaming responses (SSE / chunked transfer) work with CloudFront’s HTTP/2 streaming support but add ~5–15ms latency per hop
Net assessment:
| Factor | CloudFront helps | CloudFront adds overhead |
|---|---|---|
| Egress cost (caller on public internet) | Yes — $0.0085/GB vs $0.09/GB | |
| Request fee | $0.0100/10K = $1/million requests | |
| Streaming LLM responses | Marginally higher latency | |
| Caching of repeated prompts | No cacheable content | Wasted edge infrastructure |
| DDoS protection, rate limiting | Yes (WAF integration) | WAF cost extra |
| Geographic distribution (global clients) | Yes — edge closer to user |
Verdict: For a global deployment where callers are geographically distributed and on the public internet, CloudFront in front of a LiteLLM/ALB stack reduces data transfer costs by 90% on the delivery side. The request fee overhead ($1/million) is typically recouped at >2 GB/million average response size. For internal AWS workloads (callers within VPC), skip CloudFront — VPC endpoints dominate.
8. Multi-Region Bedrock Traffic: CRIS Cost Patterns
Cross-Region Inference System (CRIS) overview
CRIS allows Bedrock to automatically route inference requests to the highest-capacity region within a geography when the home region is throttled. Three geographic scopes exist:
- US (us-east-1, us-east-2, us-west-2)
- EU (eu-west-1, eu-west-3, eu-central-1, eu-north-1)
- APAC (ap-southeast-1, ap-northeast-1, ap-southeast-2)
Data transfer cost: geographic CRIS profiles
For geographic-scoped inference profiles, AWS does not charge inter-region data transfer fees. Pricing is based on the source region where the request originates, regardless of which region actually processes it. The request and response traverse the AWS backbone without triggering the standard $0.02/GB inter-region charge.
This is a meaningful subsidy. Without CRIS, manually routing a request from us-east-1 to us-west-2 would incur:
$0.02/GB × (request payload + response payload) × volume
At 500 GB/month of cross-region traffic: $10/month in data transfer — not significant in isolation but non-trivial at scale.
Global CRIS profiles: different story
Global CRIS profiles (routing between US, EU, APAC geographies) are a distinct product. AWS documentation does not waive inter-regional transfer charges for cross-geography routing. Budget inter-region rates ($0.02/GB) for any global profile workload where requests from EU may route to US regions or vice versa.
Multi-region active-active Bedrock deployments (non-CRIS)
Teams building their own multi-region routing (e.g., Route 53 latency-based routing to regional ALBs, each calling their regional Bedrock endpoint) face standard inter-region charges if they aggregate or fan out responses:
| Pattern | Transfer charge |
|---|---|
| Client in EU → ALB in eu-west-1 → Bedrock eu-west-1 | No inter-region charge |
| Client in US → ALB in us-east-1 → Bedrock us-west-2 | $0.02/GB both directions |
| Response aggregation across regions (fan-out) | $0.02/GB per region boundary crossed |
| Logging: streaming Bedrock responses cross-region to central S3 | $0.02/GB |
9. Cost Optimization: Prioritized Actions
Tier 1 — Free or near-free, immediate impact
S3 Gateway endpoint: Free. Add a route table entry pointing to com.amazonaws.<region>.s3 via the gateway endpoint. Eliminates NAT processing on all S3 traffic, including Knowledge Base chunk retrieval and any model artifacts. Implementation: 10 minutes in the console.
IPv6 for intra-VPC Bedrock calls: If callers are within the same VPC, IPv6 direct routing eliminates NAT entirely for same-VPC traffic. No ENI cost, no data processing charge. Requires IPv6-enabled VPC and Bedrock endpoint support (verify per region).
Same-AZ NAT routing check: Audit subnet route tables. If any subnets in AZ-b or AZ-c route through a NAT Gateway in AZ-a, add per-AZ NAT Gateways or migrate to VPC endpoints. Run aws ec2 describe-route-tables and identify cross-AZ NAT routes.
Tier 2 — Moderate setup, high ROI at scale
Bedrock Runtime Interface endpoint: Deploy bedrock-runtime Interface endpoint in each AZ where inference workloads run. At >200 GB/month Bedrock traffic, ENI cost ($43.80/month for 2-endpoint, 3-AZ) is recovered vs NAT savings within one month.
Endpoint policy scoping: Interface endpoints accept resource policies. Scope the bedrock-runtime endpoint to only your account’s IAM principals. This prevents endpoint abuse from other VPC tenants and simplifies audit.
Disable cross-zone load balancing on NLB: If using NLB in front of a LiteLLM proxy, cross-zone load balancing is enabled by default and charges $0.01/GB for cross-AZ traffic. Disable it if your application is AZ-aligned (pods in same AZ as NLB node).
Tier 3 — Architecture changes, highest impact at enterprise scale
Dedicated inference VPC with no NAT Gateway: For AI workloads, a VPC that has Interface endpoints for Bedrock, bedrock-runtime, and other required services (ECR, CloudWatch, Secrets Manager) and an S3 Gateway endpoint — but no NAT Gateway at all — eliminates the $97–$130/month NAT fixed cost and $0.045/GB processing entirely. Requires all external dependencies to have endpoints or to be co-located in the VPC.
Batch inference via S3 intermediary: For non-latency-sensitive workloads, write prompts to S3, trigger Bedrock Batch Inference, read results from S3. Batch inference uses the same token pricing with potential discounts. Data transfer cost: two S3 operations (write prompt, read result) at $0.005/1,000 requests — negligible vs. streaming API data transfer charges at scale.
PrivateLink for cross-account Bedrock access: If multiple AWS accounts share a Bedrock deployment, use PrivateLink endpoint services (rather than inter-account NAT) to share the inference endpoint. Each consumer account deploys an Interface endpoint to the provider’s endpoint service. Cost: $0.01/GB data processing (shared), much lower than routing through internet gateways.
10. CUR Line Items for Bedrock Data Transfer
Key usage types in CUR 2.0 / Legacy CUR
| CUR usage type pattern | What it represents | Service |
|---|---|---|
<region>-DataTransfer-Out-Bytes |
Data out to internet | AWS / EC2 |
<region>-DataTransfer-Regional-Bytes |
Cross-AZ transfer | AWS / EC2 |
<region>-NatGateway-Bytes |
NAT Gateway data processed | AWS / VPC |
<region>-NatGateway-Hours |
NAT Gateway hourly | AWS / VPC |
<region>-VpcEndpoint-Hours |
Interface endpoint ENI hours | AWS / VPC |
<region>-VpcEndpoint-Bytes |
Interface endpoint data processed | AWS / VPC |
USE1-APS1-AWS-In-Bytes |
Inter-region transfer in (varies by region pair) | AWS / EC2 |
Bedrock inference itself appears with line_item_operation values:
InvokeModelInference(synchronous calls)InvokeModelStreamingInference(streaming calls, added Jan 2026)RetrieveAndGenerateInference(Knowledge Bases)
As of January 2026, AWS Data Exports and CUR 2.0 surface these operation-level distinctions, enabling per-call-type cost attribution.
Athena query to surface NAT+egress attributed to Bedrock periods
-- Identify NAT Gateway cost spikes correlated with Bedrock inference peaks
SELECT
DATE_TRUNC('day', line_item_usage_start_date) AS day,
line_item_product_code,
line_item_usage_type,
SUM(line_item_unblended_cost) AS cost_usd,
SUM(line_item_usage_amount) AS usage_amount
FROM cur_database.cur_table
WHERE
line_item_usage_start_date BETWEEN DATE '2026-01-01' AND DATE '2026-06-30'
AND (
line_item_usage_type LIKE '%-NatGateway-Bytes'
OR line_item_usage_type LIKE '%-DataTransfer-Out-Bytes'
OR line_item_usage_type LIKE '%-VpcEndpoint-Bytes'
OR (line_item_product_code = 'AmazonBedrock' AND line_item_operation LIKE '%Inference%')
)
GROUP BY 1, 2, 3
ORDER BY 1, 4 DESC;
Tagging strategy for attribution
Bedrock API calls do not pass through taggable compute resources in the managed path. To attribute network costs to Bedrock workloads:
- Tag the NAT Gateway and Interface endpoints with
workload=bedrock-inference - Tag the VPC subnet route tables that carry Bedrock traffic
- Enable AWS Cost Allocation Tags on
workloadtag - Filter CUR on
resource_tags_user_workload = 'bedrock-inference'for NatGateway and VpcEndpoint resources
11. Reference Architecture: Minimum Network Cost for High-Volume Bedrock
Architecture diagram (text)
┌─────────────────────────────────────────────────────────────────┐
│ Inference VPC (3 AZs, no Internet Gateway, no NAT Gateway) │
│ │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │
│ │ AZ-a │ │ AZ-b │ │ AZ-c │ │
│ │ │ │ │ │ │ │
│ │ App pods │ │ App pods │ │ App pods │ │
│ │ (EKS) │ │ (EKS) │ │ (EKS) │ │
│ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │
│ │ │ │ │
│ └─────────────────┼─────────────────┘ │
│ │ │
│ [Endpoint ENIs] │
│ bedrock-runtime ← $0.01/GB processed │
│ bedrock ← $0.01/GB processed │
│ bedrock-agent-runtime │
│ ecr.api / ecr.dkr │
│ logs │
│ secretsmanager │
│ [S3 Gateway Endpoint — FREE] │
│ │ │
└───────────────────────────┼─────────────────────────────────────┘
│ AWS Private Backbone
▼
Amazon Bedrock Service
(same region, no internet crossing)
Cost comparison: three architectures at 500 GB/month Bedrock traffic
| Architecture | Monthly fixed | Monthly variable (500 GB) | Total/month |
|---|---|---|---|
| Public endpoint via NAT (3 AZs, cross-AZ risk) | NAT: $97.20 | $0.135/GB × 500 = $67.50 | $164.70 |
| Public endpoint via NAT (same-AZ, no cross-AZ) | NAT: $97.20 | $0.135/GB × 500 = $67.50 | $164.70 |
| VPC Interface endpoint (2 eps, 3 AZs) | ENI: $43.80 | $0.01/GB × 500 = $5.00 | $48.80 |
| Dedicated inference VPC, endpoints only, no NAT | ENI: $43.80 | $0.01/GB × 500 = $5.00 | $48.80 |
At 500 GB/month, Interface endpoints save $115.90/month ($1,391/year) vs NAT path. At 5 TB/month, savings are $1,186/month ($14,232/year).
Checklist for a new Bedrock production deployment
- [ ] Create
com.amazonaws.<region>.bedrock-runtimeInterface endpoint — required for inference - [ ] Create
com.amazonaws.<region>.bedrockInterface endpoint — required for control-plane - [ ] Create S3 Gateway endpoint in same VPC — free, eliminates S3 NAT charges
- [ ] Enable private DNS on Interface endpoints — allows SDK to resolve
bedrock.us-east-1.amazonaws.comto private ENI - [ ] Set endpoint policy to restrict to your account’s principals
- [ ] Audit subnet route tables: no Bedrock subnets should have a NAT Gateway default route
- [ ] If NAT Gateway still needed for other traffic: deploy one per AZ to eliminate cross-AZ charges
- [ ] Enable CUR 2.0 with resource IDs — tag NAT GW and endpoints with
workload=bedrock - [ ] If using Knowledge Bases: confirm no OpenSearch VPC in different VPC without peering (vector writes through public NAT = unexpected charges)
- [ ] For CRIS: use geographic-scoped profiles (US/EU/APAC) — no inter-region data transfer charges
- [ ] For multi-region active-active: budget $0.02/GB for any cross-region response aggregation
Sources
- Amazon Bedrock VPC Interface Endpoints — AWS Documentation
- Amazon Bedrock expands AWS PrivateLink support (Feb 2026)
- Amazon VPC Pricing
- AWS Data Exports: Granular Bedrock operation visibility (Jan 2026)
- Understanding Amazon Bedrock CUR data — AWS Documentation
- Cross-Region Inference — Amazon Bedrock Documentation
- Geographic cross-Region inference — Amazon Bedrock Documentation
- Exploring Data Transfer Costs for AWS NLB — AWS Networking Blog
- Gateway endpoints for Amazon S3 — AWS Documentation
- Amazon S3 Vectors GA (Dec 2025)
- AWS NAT Gateway Pricing: Ultimate Cost Reduction Guide — SpendArk
- Amazon VPC Pricing: 4 Charges Hiding Behind the Free VPC — Cloud Burn
- DataTransfer-Out-Bytes CUR billing codes — Vantage CUR Reference
- AWS Data Transfer Pricing 2026 — LeanOps
- Amazon Bedrock Pricing: Token Rates Hide a $350/Month Trap — Cloud Burn
- Bedrock for AI Coding Tools: Mantle vs Gateway vs LiteLLM — DEV Community