AWSCost

AWS cost · Site-to-Site VPN

Site-to-Site VPN bills $36.50/month, tunnels down

Most AWS resources give some signal when they stop being useful. A Site-to-Site VPN does not. The charge sits on the connection object, so a VPN whose far end was switched off months ago - both tunnels down ever since - bills exactly what it billed when it carried traffic.

A connection costs $0.05/hour in us-east-1 - about $36.50/month - whether the tunnels are up or down. Check the bandwidth option before you assume that figure: a connection on large tunnels bills $0.60/hour instead, around $438/month.

What a VPN connection costs

WhatCostNote
One connection, standard tunnels~$36.50/month$0.05/connection-hour, us-east-1
One connection, large tunnels~$438.00/month$0.60/hour - twelve times standard
Both tunnels down for a monththe samethe connection bills, not the traffic
Data out through the tunnelstandard egress rateson top of the hourly charge

The gap between those first two rows is the one worth checking. Large tunnel bandwidth is a setting on the connection, not a different product, so a bill built on the $36.50 figure understates a large-tunnel connection by about $401/month.

Down is not free

The connection being available says nothing about whether either tunnel is established. Available means the object exists and AWS is holding its end up. Holding its end up is what you pay for. A hybrid setup replaced by Direct Connect, an office that closed, a partner integration that ended: in every case the AWS side keeps waiting, and keeps charging.

That makes it different from an idle Transit Gateway attachment, where you at least have to read a metric to know. Here the resource itself will say it has been dead for months, if anyone asks.

How to ask it

Tunnel state comes back on the describe call, along with the timestamp of the last change. No CloudWatch, no cost, no waiting:

# tunnel state and bandwidth tier, straight off the describe
aws ec2 describe-vpn-connections \
  --query 'VpnConnections[?State==`available`].{Id:VpnConnectionId,Bandwidth:Options.TunnelBandwidth,Tunnels:VgwTelemetry[].Status,Changed:VgwTelemetry[].LastStatusChange}' \
  --output json

# only if the tunnels are up: has anything crossed them in 14 days?
aws cloudwatch get-metric-statistics \
  --namespace AWS/VPN --metric-name TunnelDataIn \
  --dimensions Name=VpnId,Value=vpn-0123456789abcdef0 \
  --start-time 2026-07-29T00:00:00Z \
  --end-time   2026-08-12T00:00:00Z \
  --period 86400 --statistics Sum

Every tunnel reading DOWN, with a last status change older than the window, is the strongest finding on any cost report: a resource that has demonstrably done nothing for weeks and billed for every hour of it.

What the fix costs

Ask the far end before you touch anything. A tunnel that has been down for a month is either a decommission nobody told you about or an outage nobody noticed, and the two look identical from the AWS side. Deleting the second one turns a quiet failure into a loud one.

Once it is confirmed dead, deleting the connection also deletes its configuration - the pre-shared keys, the tunnel addresses, the routing. Rebuilding means coordinating a change with whoever owns the hardware at the other end, which is rarely a same-day operation. Export the configuration before you delete it.

# MUTATING - deletes the connection and its configuration
aws ec2 delete-vpn-connection --vpn-connection-id vpn-0123456789abcdef0

Want to know whether you are paying for a tunnel that has been down for months? Connect your account read-only and see what it is wasting, in real dollars.

Connect your AWS

The role can only read - Get, Describe, List, nothing else. Read the exact permissions before you deploy it, and delete the stack whenever you want.

Frequently asked questions

How much does an AWS Site-to-Site VPN cost?+

$0.05 per hour for each connection - about $36.50/month in us-east-1 - plus standard data transfer charges for traffic leaving AWS. A connection using large tunnel bandwidth bills $0.60/hour instead, which is about $438/month.

Do I still pay if the VPN tunnels are down?+

Yes. The charge is for the connection object, not for the tunnels being established. A VPN whose far end was decommissioned months ago, with both tunnels down the entire time, costs exactly the same as one carrying traffic all day. It is one of the few AWS resources that bills identically whether it works or not.

Why is my VPN connection more expensive than $36.50 a month?+

Check the tunnel bandwidth option. Large tunnels bill $0.60/hour rather than $0.05, so one connection on that setting is around $438/month - about $401 more than the standard rate people quote. Connections through a VPN concentrator bill differently again, through the concentrator rather than per connection.

How do I check whether a VPN is actually being used?+

Start with the tunnel status, which comes back on the describe call for free - no metrics needed. If every tunnel reads DOWN and the last status change was weeks ago, nothing has crossed that VPN in weeks. If the tunnels are up, sum TunnelDataIn and TunnelDataOut over two weeks to see whether anything is actually flowing.

Should I delete a VPN with both tunnels down?+

Not before you ask the far end. A down tunnel means the same thing whether the far side was decommissioned deliberately or is broken and nobody has noticed - and the second case is an outage, not a saving. Confirm with whoever owns the customer gateway first.

Is a Site-to-Site VPN cheaper than Direct Connect?+

On fixed cost, yes, by a wide margin - $36.50/month against a port charge that starts far higher. Direct Connect earns it back on data transfer rates and on latency consistency, so the comparison only favours it at sustained volume. A VPN nobody uses is worse than either.

Related cost breakdowns

More AWS cost breakdowns