## TL;DR
AWSDataTransfer is a rollup, not a single service, so a spike means something started moving a lot of bytes. Slice the CUR by usage type and operation to find the exact transfer type, trace it to the service and resources, then fix the traffic pattern.

## Use this when
- The AWSDataTransfer line item jumps month over month.
- Cost Explorer shows transfer as a growing share of the bill.
- An architecture change preceded the spike.

## Not for this skill when
- The spike is in CloudFront or Direct Connect line items. Those are separate.
- Transfer is high but flat. That is an architecture cost to optimize, not a spike to trace.

## Steps
1. In the CUR, filter line_item_product_code to AWSDataTransfer and group by usage_type. Verify: one or two usage types dominate the spike.
2. Add operation and resource ID to the grouping. Verify: you can name the service and the specific resources moving the bytes.
3. Classify the transfer: internet egress, cross-region, cross-AZ, or NAT Gateway processing. Verify: the usage type maps to one of these.
4. Trace the cause: a new replication, a backup crossing regions, an app pulling from a distant bucket. Verify: the traffic pattern matches a real workload change.
5. Fix the pattern: keep traffic in-region, use VPC endpoints, or move the compute to the data. Verify: next month's transfer line drops.

### Cross-region replication variant
S3 cross-region replication shows up here fast. Verify: the replication rules match the buckets in the usage data.

Compatibility: AWS CUR and Cost Explorer, all regions.

## Why it happens
Transfer pricing is per-GB and directional, and a single architectural choice (multi-region active-active, chatty cross-AZ services) can multiply bytes silently. The rollup line hides which choice is responsible until you slice it.

## Edge cases / pitfalls
- NAT Gateway data processing is billed separately from the transfer itself; check both.
- Cross-AZ transfer inside a VPC is easy to miss because it feels free. It is not.
- The first GB per month per region is free, which makes small spikes look odd in the data.
- VPC endpoints eliminate NAT and internet egress for AWS service traffic; they are the usual fix.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_g3VEBYjb8tSakFSZB1DeTQ