AWSCost

AWS cost · Transit Gateway

Transit Gateway attachments cost $36.50/month each

A Transit Gateway replaces a mesh of VPC peering connections with a hub, and it does that well. What it costs is a fixed hourly charge per attachment. That charge keeps running long after the VPC on the other end has been emptied, and no console view adds it up for you.

Each attachment costs $0.05/hour in us-east-1 - about $36.50/month - traffic or no traffic. A hub-and-spoke network that outlived two of its spokes is paying $73/month for routes to nothing. The gateway is not the unit of cost; the attachment is.

What a Transit Gateway charges for

WhatCostNote
One attachment~$36.50/month$0.05/attachment-hour, us-east-1
A hub with six spokes~$219.00/monthbefore a single byte moves
Data processed through the gateway$0.02/GBon top, and only for traffic that flows
The gateway itself, no attachments$0.00the attachment is the unit of cost

VPC, VPN, Connect, peering and Direct Connect gateway attachments all bill at the same hourly rate. There is no cheaper kind to prefer.

Why the abandoned ones survive

Decommissioning a VPC runs off a checklist written by whoever owns the workload. The attachment belongs to the network team instead. So the instances go, the databases go, and the attachment stays - available, healthy, and identical in the console to one carrying production traffic.

Sharing makes it harder to see. A gateway shared across accounts bills each attachment to the account that owns it, not to the account that owns the gateway. The team reading the network bill cannot see the spokes. The teams paying for the spokes are not reading the network bill.

How to find the ones doing nothing

List the attachments with their owner and the resource on the other end, then total the bytes each one moved over the last two weeks:

# attachments, and which account pays for each
aws ec2 describe-transit-gateway-attachments \
  --query 'TransitGatewayAttachments[?State==`available`].{Id:TransitGatewayAttachmentId,Type:ResourceType,Owner:ResourceOwnerId,Resource:ResourceId}' \
  --output table

# bytes through one attachment over 14 days - a flat 0 is a route to nothing
aws cloudwatch get-metric-statistics \
  --namespace AWS/TransitGateway --metric-name BytesIn \
  --dimensions Name=TransitGatewayAttachment,Value=tgw-attach-0123456789abcdef0 \
  --start-time 2026-07-29T00:00:00Z \
  --end-time   2026-08-12T00:00:00Z \
  --period 86400 --statistics Sum

Two things to know before you trust the output. Attachment-level metrics have to be enabled on the gateway, so an empty result can mean the metric was never published rather than that no traffic flowed - unknown, not idle. And compare the owner column against your own account id: an attachment owned by another account is on their bill, not yours, so it is not a saving you can claim.

What the fix costs

Deleting an attachment severs routing to that VPC, and the failure does not announce itself as a network change. It surfaces as some service timing out, reported by whoever depended on the one path nobody documented.

Remove the routes that point at the attachment first and leave it in place for a few days. A route is restored in seconds if something breaks; the attachment takes minutes to rebuild and needs the owning account to accept it again if it crosses an account boundary.

# MUTATING - severs routing to that VPC
aws ec2 delete-transit-gateway-vpc-attachment \
  --transit-gateway-attachment-id tgw-attach-0123456789abcdef0

If the traffic is real but expensive, the question becomes how much of it needed to cross the gateway at all - the same argument as cross-AZ traffic and NAT gateway processing - per-GB charges on paths chosen by architecture, not by need.

Want to know which attachments are routes to nothing? Connect your account read-only and see what it is wasting, in real dollars.

Connect your AWS

The role can only read - Get, Describe, List, nothing else. Read the exact permissions before you deploy it, and delete the stack whenever you want.

Frequently asked questions

How much does a Transit Gateway attachment cost?+

$0.05 per hour for each attachment - about $36.50/month in us-east-1 - plus $0.02 per GB of data processed through the gateway. The hourly charge applies to every attachment kind: VPC, VPN, Connect, peering and Direct Connect gateway.

Does a Transit Gateway cost money with no traffic?+

Yes. The attachment bills by the hour for as long as it exists, and traffic only adds the per-GB processing charge on top. An attachment to a VPC that was decommissioned months ago costs the same as one carrying production traffic.

Who pays for an attachment on a shared Transit Gateway?+

The account that owns the attachment, not the account that owns the gateway. If a gateway is shared across accounts through Resource Access Manager, each spoke account pays its own attachment hours - so the hub account's bill will not show what the spokes are spending.

Is a Transit Gateway cheaper than VPC peering?+

Not on fixed cost. VPC peering has no hourly charge at all; you pay only for cross-AZ or cross-region data transfer. A Transit Gateway charges $36.50/month per attachment before any traffic, and earns that back by replacing a mesh of peering connections with one hub. For two or three VPCs, peering is usually cheaper.

How do I tell whether an attachment is carrying traffic?+

Sum the BytesIn and BytesOut metrics per attachment over two weeks. A sustained zero means nothing is routing through it. Note that a low-but-not-zero figure can be background chatter rather than real use, so treat that as worth investigating rather than as proof.

What happens if I delete an attachment that is still needed?+

Routing to that VPC stops immediately, and anything reaching it by a path the metrics did not capture breaks with it. Delete the routes first and watch for failures before removing the attachment - the route change is reversible in seconds, the attachment takes minutes to rebuild.

Related cost breakdowns

More AWS cost breakdowns