AWS PrivateLink Cost Analysis

AWS PrivateLink lets you expose services across VPCs and accounts without exposing them to the public Internet. It is the right answer for service-to-service connectivity at enterprise scale — particularly for SaaS providers exposing endpoints to customers, internal platform teams exposing shared services, or organizations consolidating cross-account workloads.

PrivateLink pricing is deceptively simple on paper: $0.01/hour per Interface Endpoint per AZ, plus $0.01/GB processing. In practice, the per-AZ hourly fees compound aggressively at scale, and the processing fees often exceed peering or TGW alternatives. This guide breaks down PrivateLink costs in production scenarios, when PrivateLink is cheaper than the alternatives, and what to negotiate.

How PrivateLink bills

Component	Rate	Notes
Interface Endpoint hourly	$0.01 / hour per AZ	Each AZ enabled per endpoint
Data processing	$0.01 / GB	Both directions billable for PrivateLink consumer side
Gateway Endpoint (S3/DynamoDB)	Free	Not technically PrivateLink, often confused
NLB on PrivateLink service side	$0.0225 / hour + LCU	Required for the producer side

The per-AZ multiplication is the cost driver most teams miss. A single Interface Endpoint enabled in three AZs bills $0.03/hour, or $263/year per endpoint. An environment with 80 endpoints across 3 AZs bills $21K/year on hourly fees alone — before any traffic.

PrivateLink vs alternatives

Pattern	Best fit	Cost vs PrivateLink
VPC Endpoint Gateway (S3/DynamoDB)	S3, DynamoDB only	Free — always preferred where applicable
VPC Peering	2-4 VPCs, broad connectivity	Cheaper for low endpoint count, higher operational complexity
Transit Gateway	5+ VPCs, hub-spoke	Cheaper at scale for multi-VPC, doesn't solve cross-account exposure
NLB + Internet	Customer-facing SaaS	Adds egress fees, often more expensive at scale

PrivateLink shines specifically when: (1) you need service-level exposure rather than VPC-wide connectivity, (2) the connection crosses account or organizational boundaries, or (3) you need IAM-based access control on the connection itself.

When PrivateLink wins on cost

For sustained per-service traffic above ~3 TB/month per VPC, PrivateLink usually beats NAT Gateway for AWS service access:

• NAT Gateway: $0.045/GB processing + egress fees
• PrivateLink: $0.01/GB processing + $0.01/hour per AZ

Crossover math: at 3 TB/month per service per VPC, NAT processing alone is $135/month while PrivateLink processing is $30/month + ~$22/month in hourly fees (3 AZs). PrivateLink wins by ~$80/month. Below 3 TB/month, the hourly fees can overwhelm the processing savings.

This is the calculus that drives NAT Gateway cost reduction in mature environments — replace NAT-routed AWS service traffic with PrivateLink endpoints once volume justifies.

Connection logging and the audit trail

One operational benefit worth flagging in a cost discussion: every PrivateLink Interface Endpoint generates connection-level logs that simplify compliance audits and service-to-service traffic accounting. For regulated workloads (PCI, HIPAA, FedRAMP), this audit trail is sometimes the deciding factor over cheaper alternatives. Build the compliance value into the EDP scoping conversation alongside raw cost — it strengthens the negotiating position on the per-AZ hourly fees.

The over-provisioning problem

The most common PrivateLink waste is endpoints enabled in AZs that carry no traffic. Default Terraform modules often provision endpoints in all three AZs for "consistency". If 90% of your application traffic stays in AZ-1, the endpoints in AZ-2 and AZ-3 are paying $175/year each for nothing.

The fix: audit endpoint utilization by AZ via VPC Flow Logs. Disable endpoints in AZs that carry less than ~1 GB/month. Re-enable on demand if traffic shifts.

Cross-account exposure economics

PrivateLink's true differentiator is cross-account service exposure. A SaaS provider exposing an endpoint to 200 customer VPCs pays nothing additional on the producer side — the customer pays the consumer-side endpoint and processing fees. This is the right architectural pattern for any SaaS company building on AWS.

On the consumer side, customers pay $0.01/hour per AZ and $0.01/GB processing. For high-volume consumers, that quickly justifies negotiated rate cards or alternative connectivity.

The contract levers

PrivateLink fees roll into the broader EDP data transfer category. Specific levers we apply:

• Per-AZ hourly fee waivers: AWS will sometimes credit hourly endpoint fees on high-attachment environments as part of EDP bundling.
• Processing fee discounts: Above ~$200K annual PrivateLink processing, AWS will discount the $0.01/GB rate by 20-35 percent.
• SaaS provider credits: For producers exposing services to customers, AWS sometimes provides credits on the NLB and PrivateLink stack as part of co-sell or partner programs.
• Bundle with TGW/peering: The cleanest path is to negotiate the aggregate "private connectivity" line that combines PrivateLink, TGW, and peering.

Case study: $128K PrivateLink baseline

A multi-tenant SaaS provider we engaged with had $128K annualized PrivateLink spend. Composition: 67% hourly endpoint fees, 33% processing. Their environment had 124 Interface Endpoints across 3 AZs, mostly auto-provisioned by Terraform modules.

The intervention:

• Audited endpoint utilization per AZ. Found 41 of 372 (endpoint × AZ) combinations carried under 1 GB/month.
• Disabled underutilized AZ-side endpoints. Eliminated 41 × $87/year = $3,570 in hourly fees.
• Replaced eight high-traffic NAT-routed AWS service paths with new PrivateLink endpoints. Reduced NAT processing by $28K/year. Net of new PrivateLink fees, $19K/year savings.
• Negotiated 32 percent discount on the aggregate connectivity line in EDP renewal.

Net result: PrivateLink spend dropped to $66K annualized, with another $19K in NAT savings. Combined connectivity cost down 49 percent.

Action checklist

1. Inventory every Interface Endpoint across every VPC. Note service, AZs enabled, and average monthly traffic.
2. Audit endpoint utilization by AZ. Disable any AZ-side endpoint below ~1 GB/month.
3. Identify high-volume NAT-routed AWS service paths. Replace with PrivateLink where the volume justifies the hourly fee.
4. For SaaS providers: ensure customer-facing service exposure uses PrivateLink rather than public NLB + Internet to minimize egress.
5. Scope PrivateLink into the connectivity bundle of your next EDP renewal.
6. Contact our advisory team for a PrivateLink cost audit benchmarked against $2.4B+ of reviewed AWS spend.

PrivateLink is the cleanest answer for cross-account and cross-organization service connectivity on AWS. It is also one of the easiest categories to over-provision. The combination of AZ-level rightsizing, deliberate NAT replacement, and EDP-level connectivity bundling routinely returns 35-50 percent on PrivateLink spend. See our complete data transfer cost guide for how connectivity fits the broader transfer-cost picture.

Frequently asked questions