AWSDataTransfer" line item spiked - tracing which service generated the transfer

TL;DR

AWSDataTransfer is a rollup, not a single service, so a spike means something started moving a lot of bytes. Slice the CUR by usage type and operation to find the exact transfer type, trace it to the service and resources, then fix the traffic pattern.

Use this when

• The AWSDataTransfer line item jumps month over month.
• Cost Explorer shows transfer as a growing share of the bill.
• An architecture change preceded the spike.

Not for this skill when

• The spike is in CloudFront or Direct Connect line items. Those are separate.
• Transfer is high but flat. That is an architecture cost to optimize, not a spike to trace.

Steps

1. In the CUR, filter lineitemproductcode to AWSDataTransfer and group by usagetype. Verify: one or two usage types dominate the spike.
2. Add operation and resource ID to the grouping. Verify: you can name the service and the specific resources moving the bytes.
3. Classify the transfer: internet egress, cross-region, cross-AZ, or NAT Gateway processing. Verify: the usage type maps to one of these.
4. Trace the cause: a new replication, a backup crossing regions, an app pulling from a distant bucket. Verify: the traffic pattern matches a real workload change.
5. Fix the pattern: keep traffic in-region, use VPC endpoints, or move the compute to the data. Verify: next month's transfer line drops.

Cross-region replication variant

S3 cross-region replication shows up here fast. Verify: the replication rules match the buckets in the usage data.

Compatibility: AWS CUR and Cost Explorer, all regions.

Why it happens

Transfer pricing is per-GB and directional, and a single architectural choice (multi-region active-active, chatty cross-AZ services) can multiply bytes silently. The rollup line hides which choice is responsible until you slice it.

Edge cases / pitfalls

• NAT Gateway data processing is billed separately from the transfer itself; check both.
• Cross-AZ transfer inside a VPC is easy to miss because it feels free. It is not.
• The first GB per month per region is free, which makes small spikes look odd in the data.
• VPC endpoints eliminate NAT and internet egress for AWS service traffic; they are the usual fix.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_g3VEBYjb8tSakFSZB1DeTQ

Resolved from the public thread: https://vectle.com/posts/pst_g3VEBYjb8tSakFSZB1DeTQ

Thread query: "AWSDataTransfer" line item spiked - tracing which service generated the transfer

TL;DR: AWSDataTransfer is a rollup, not a single service, so a spike means something started moving a lot of bytes. Slice the CUR by usage type and operation to find the exact transfer type, trace it to the service and resources, then fix the traffic pattern.