VPC Lattice Cost Visibility in AWS Cost Explorer

Part 1: VPC Lattice Pricing Dimensions

VPC Lattice has two pricing models depending on whether you are using Lattice Services or Lattice Resources:

Services Pricing

Pricing Dimension	Description	Rate (us-east-1)
Hourly charge	Per provisioned service per hour	$0.025/hr
Data processing	Per GB sent to and from each service	$0.025/GB
Requests	HTTP/gRPC requests or TCP connections received by a service (first 300K requests/hr free per service)	$0.10 per 1M requests/hr

No additional inter-AZ data charges apply for Services.

Resources Pricing

Pricing Dimension	Description	Rate (us-east-1)
Hourly charge (resource endpoint)	Per resource associated with a resource endpoint	$0.02/hr
Hourly charge (service network)	Per resource associated with a service network	$0.10/hr
Data processing — Provider	Per GB providing access to a resource through a resource gateway	$0.006/GB
Data processing — Consumer (first 1 PB)	Per GB accessing via resource endpoint, service network endpoint, or service association	$0.01/GB
Data processing — Consumer (next 4 PB)	Tiered rate for 1–5 PB/month	$0.006/GB
Data processing — Consumer (over 5 PB)	Tiered rate above 5 PB/month	$0.004/GB

No additional inter-AZ data charges. No hourly charges for resource endpoints, service network endpoints, or service network associations. ** Prices vary per region. See the VPC Lattice pricing page for current rates.*

Part 2: How VPC Lattice Appears in Billing

Service Name in Cost Explorer

Service filter value: Amazon Virtual Private Cloud VPC Lattice does NOT have its own service-level entry. You must filter to the VPC service and then drill down by Usage Type.

Usage Type Codes

Usage Type Code	Description	Units
Lattice Services	Lattice Services	Lattice Services
{{region}}-VPCLattice-Service-Hourly	Per-service provisioning charge (billed per hour)	Hours
{{region}}-VPCLattice-DataProcessing-Bytes	Data processed through VPC Lattice services	GB
{{region}}-VPCLattice-RequestCount-Charged	Billed HTTP/gRPC requests or TCP new connections	Count
{{region}}-VPCLattice-RequestCount-Free	Free-tier HTTP requests / TCP connections (no cost)	Count
{{region}}-VPCLattice-ConnectionCount-Charged	Billed TCP connection minutes	Count
{{region}}-VPCLattice-ConnectionCount-Free	Free-tier TCP connection minutes (no cost)	Count
Lattice Resources	Lattice Resources	Lattice Resources
{{region}}-VpcResource-Consumer-Bytes	Data transferred by consumer through resource configuration	GB
{{region}}-VpcResource-Provider-Bytes	Data transferred by provider through resource configuration	GB
{{region}}-VpcEndpoint-Resource-Hours	Resource endpoint provisioning charge (billed per hour)	Hours
{{region}}-VpcLattice-Service-Network-Resource-Hours	Service network resource provisioning charge (billed per hour)	Hours
ODB++	ODB++	ODB++
{{region}}-VpcResource-ODB-Consumer-Bytes	ODB data transferred by consumer through resource configuration	GB
{{region}}-VpcResource-ODB-Provider-Bytes	ODB data transferred by provider through resource configuration	GB
{{region}}-VpcEndpoint-ODB-Resource-Hours	ODB resource endpoint provisioning charge (billed per hour)	Hours
{{region}}-VpcLattice-Service-Network-ODB-Resource-Hours	ODB service network resource provisioning charge (billed per hour)	Hours

Note: AWS uses inconsistent casing — **VPCLattice** in some codes and **VpcLattice** in others. Account for both when filtering.

++Oracle Database@AWS (ODB): ODB usage type codes represent VPC Lattice charges for Oracle Database@AWS — a managed integration that connects OCI-hosted Oracle databases to AWS services (S3, Zero-ETL for Redshift). VPC Lattice automatically provisions a service network, service-network endpoint, and resource gateway to support ODB connectivity. ODB uses VPC Lattice Resources pricing — the same rates in the Resources table above apply.

Region code examples: USE1 (us-east-1), USW2 (us-west-2), EUW1 (eu-west-1), APS1 (ap-southeast-1)

Part 3: Tagging Strategy for Per-Service Cost Attribution

Why Tags Matter

Since all Lattice charges roll up under the VPC service, cost allocation tags are the primary mechanism for attributing costs to individual Lattice services, teams, or environments in Cost Explorer.

Recommended Tag Schema

Tag Key	Purpose	Example Values
ServiceName	Identify the specific Lattice service	payments-api, order-service
Environment	Separate prod/dev/staging costs	prod, staging, dev
CostCenter	Team or business unit attribution	platform-team, checkout-squad
Project	Project-level grouping	migration-phase2, lattice-poc

Tag All VPC Lattice Entities

Apply tags consistently across all Lattice resources to ensure complete cost attribution:

• Service networks
• Services
• Target groups
• Listeners and rules
• Resource configurations
• Resource gateways
• Resource endpoints
• Service network endpoints If you only tag services but not target groups, some data processing costs may not be attributable.

Note: Both resource endpoints and service network endpoints are VPC Endpoints (vpce-) and are tagged identically via ec2 create-tags or AWS::EC2::VPCEndpoint Tags. The difference is scope: a resource endpoint (VpcEndpointType: Resource) connects to a single resource configuration, while a service network endpoint (VpcEndpointType: ServiceNetwork) provides access to all services and resources on the network.*

Applying Tags via CLI

# Tag a VPC Lattice service
aws vpc-lattice tag-resource \
  --resource-arn arn:aws:vpc-lattice:us-east-1:123456789012:service/svc-0abc123def456 \
  --tags Key=ServiceName,Value=payments-api \
         Key=Environment,Value=prod \
         Key=CostCenter,Value=platform-team

# Tag a target group
aws vpc-lattice tag-resource \
  --resource-arn arn:aws:vpc-lattice:us-east-1:123456789012:targetgroup/tg-0abc123def456 \
  --tags Key=ServiceName,Value=payments-api \
         Key=Environment,Value=prod \
         Key=CostCenter,Value=platform-team

# Tag a service network
aws vpc-lattice tag-resource \
  --resource-arn arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-0abc123def456 \
  --tags Key=ServiceName,Value=shared-network \
         Key=Environment,Value=prod \
         Key=CostCenter,Value=platform-team

# Tag a resource gateway
aws vpc-lattice tag-resource \
  --resource-arn arn:aws:vpc-lattice:us-east-1:123456789012:resourcegateway/rgw-0abc123def456 \
  --tags Key=ServiceName,Value=payments-api \
         Key=Environment,Value=prod \
         Key=CostCenter,Value=platform-team

# Tag a resource configuration
aws vpc-lattice tag-resource \
  --resource-arn arn:aws:vpc-lattice:us-east-1:123456789012:resourceconfiguration/rcfg-0abc123def456 \
  --tags Key=ServiceName,Value=payments-api \
         Key=Environment,Value=prod \
         Key=CostCenter,Value=platform-team

# Tag a resource endpoint (VPC endpoint providing access to a single resource configuration)
aws ec2 create-tags \
  --resources vpce-0abc123def456 \
  --tags Key=ServiceName,Value=payments-rds \
         Key=Environment,Value=prod \
         Key=CostCenter,Value=platform-team

# Tag a service network endpoint (VPC endpoint providing access to all services/resources on a service network)
aws ec2 create-tags \
  --resources vpce-0def456abc789 \
  --tags Key=ServiceName,Value=shared-network \
         Key=Environment,Value=prod \
         Key=CostCenter,Value=platform-team

Applying Tags via CloudFormation

Resources:
  PaymentsService:
    Type: AWS::VpcLattice::Service
    Properties:
      Name: payments-api
      AuthType: AWS_IAM
      Tags:
        - Key: ServiceName
          Value: payments-api
        - Key: Environment
          Value: prod
        - Key: CostCenter
          Value: platform-team

  PaymentsTargetGroup:
    Type: AWS::VpcLattice::TargetGroup
    Properties:
      Name: payments-api-targets
      Type: INSTANCE
      Config:
        Port: 443
        Protocol: HTTPS
        VpcIdentifier: !Ref VpcId
      Tags:
        - Key: ServiceName
          Value: payments-api
        - Key: Environment
          Value: prod
        - Key: CostCenter
          Value: platform-team

  PaymentsResourceGateway:
    Type: AWS::VpcLattice::ResourceGateway
    Properties:
      Name: payments-resource-gw
      VpcIdentifier: !Ref VpcId
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      Tags:
        - Key: ServiceName
          Value: payments-api
        - Key: Environment
          Value: prod
        - Key: CostCenter
          Value: platform-team

  PaymentsResourceConfiguration:
    Type: AWS::VpcLattice::ResourceConfiguration
    Properties:
      Name: payments-rds-config
      Type: ARN
      ResourceGatewayIdentifier: !Ref PaymentsResourceGateway
      ResourceConfigurationDefinition:
        ArnResource:
          Arn: !GetAtt PaymentsDB.DBInstanceArn
      Tags:
        - Key: ServiceName
          Value: payments-api
        - Key: Environment
          Value: prod
        - Key: CostCenter
          Value: platform-team

  # Resource endpoint — provides access to a single resource configuration.
  # Uses VpcEndpointType: Resource with a ResourceConfigurationArn.
  PaymentsRdsEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref ConsumerVpcId
      ResourceConfigurationArn: !GetAtt PaymentsResourceConfiguration.Arn
      VpcEndpointType: Resource
      SubnetIds:
        - !Ref ConsumerSubnet1
      Tags:
        - Key: ServiceName
          Value: payments-rds
        - Key: Environment
          Value: prod
        - Key: CostCenter
          Value: platform-team

  # Service network endpoint — provides access to ALL services and resource
  # configurations on the service network. Uses VpcEndpointType: ServiceNetwork.
  SharedNetworkEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref ConsumerVpcId
      ServiceNetworkArn: !GetAtt SharedServiceNetwork.Arn
      VpcEndpointType: ServiceNetwork
      SubnetIds:
        - !Ref ConsumerSubnet1
        - !Ref ConsumerSubnet2
      Tags:
        - Key: ServiceName
          Value: shared-network
        - Key: Environment
          Value: prod
        - Key: CostCenter
          Value: platform-team

Applying Tags via CDK (TypeScript)

import * as vpclattice from 'aws-cdk-lib/aws-vpclattice';
import { Tags } from 'aws-cdk-lib';

const service = new vpclattice.CfnService(this, 'PaymentsService', {
  name: 'payments-api',
  authType: 'AWS_IAM',
  tags: [
    { key: 'ServiceName', value: 'payments-api' },
    { key: 'Environment', value: 'prod' },
    { key: 'CostCenter', value: 'platform-team' },
  ],
});

// Resource Gateway
const resourceGateway = new vpclattice.CfnResourceGateway(this, 'PaymentsResourceGw', {
  name: 'payments-resource-gw',
  vpcIdentifier: vpc.vpcId,
  subnetIds: vpc.privateSubnets.map(s => s.subnetId),
  tags: [
    { key: 'ServiceName', value: 'payments-api' },
    { key: 'Environment', value: 'prod' },
    { key: 'CostCenter', value: 'platform-team' },
  ],
});

// Resource Configuration
const resourceConfig = new vpclattice.CfnResourceConfiguration(this, 'PaymentsRdsConfig', {
  name: 'payments-rds-config',
  type: 'ARN',
  resourceGatewayIdentifier: resourceGateway.attrId,
  resourceConfigurationDefinition: {
    arnResource: { arn: rdsInstance.instanceArn },
  },
  tags: [
    { key: 'ServiceName', value: 'payments-api' },
    { key: 'Environment', value: 'prod' },
    { key: 'CostCenter', value: 'platform-team' },
  ],
});

// Resource Endpoint — access to a single resource configuration
import * as ec2 from 'aws-cdk-lib/aws-ec2';

const resourceEndpoint = new ec2.CfnVPCEndpoint(this, 'PaymentsRdsEndpoint', {
  vpcId: consumerVpc.vpcId,
  resourceConfigurationArn: resourceConfig.attrArn,
  vpcEndpointType: 'Resource',
  subnetIds: consumerVpc.privateSubnets.map(s => s.subnetId),
});
Tags.of(resourceEndpoint).add('ServiceName', 'payments-rds');
Tags.of(resourceEndpoint).add('Environment', 'prod');
Tags.of(resourceEndpoint).add('CostCenter', 'platform-team');

// Service Network Endpoint — access to ALL services and resources on the network
const serviceNetworkEndpoint = new ec2.CfnVPCEndpoint(this, 'SharedNetworkEndpoint', {
  vpcId: consumerVpc.vpcId,
  serviceNetworkArn: serviceNetwork.attrArn,
  vpcEndpointType: 'ServiceNetwork',
  subnetIds: consumerVpc.privateSubnets.map(s => s.subnetId),
});
Tags.of(serviceNetworkEndpoint).add('ServiceName', 'shared-network');
Tags.of(serviceNetworkEndpoint).add('Environment', 'prod');
Tags.of(serviceNetworkEndpoint).add('CostCenter', 'platform-team');

Part 4: Activating Cost Allocation Tags

Tags must be activated in the Billing console before they appear in Cost Explorer.

Steps

1. Navigate to Billing and Cost Management → Cost Allocation Tags
2. Select the User-defined cost allocation tags tab
3. Find your tags (they appear after first use — can take up to 24 hours)
4. Select the tags and click Activate
5. Wait ~24 hours for tags to start populating in Cost Explorer

Important: Cost allocation tags only apply going forward from activation. They do not retroactively tag historical cost data.

Part 5: Viewing VPC Lattice Costs in Cost Explorer

Method 1: Filter by Usage Type (No Tags Required)

This isolates all VPC Lattice charges across your account:

1. Open Cost Explorer
2. Filter: Service = Amazon Virtual Private Cloud
3. Filter: Usage Type → select values containing VPCLattice, VpcLattice, VpcResource, or VpcEndpoint
4. Group by: Usage Type
5. Granularity: Daily or Monthly

This shows total Lattice spend broken down by charge type (hourly, data processing, requests). See Example 1 at the end of this document.

Method 2: Group by Cost Allocation Tag (Per-Service Breakdown)

This gives you per-Lattice-service cost attribution:

1. Open Cost Explorer
2. Filter: Service = Amazon Virtual Private Cloud
3. Filter: Usage Type → contains VPCLattice, VpcLattice, VpcResource, or VpcEndpoint
4. Group by: Tag → ServiceName (or your chosen tag key)
5. Granularity: Daily or Monthly

This shows cost per individual Lattice service or Resource. See Example 2 and Example 3 at the end of this document.

Method 3: CLI Query

# Total VPC Lattice costs grouped by usage type
aws ce get-cost-and-usage \
  --time-period Start=2025-05-01,End=2025-06-01 \
  --granularity MONTHLY \
  --metrics "UnblendedCost" \
  --filter '{
    "And": [
      {"Dimensions": {"Key": "SERVICE", "Values": ["Amazon Virtual Private Cloud"]}},
      {"Dimensions": {"Key": "USAGE_TYPE", "Values": [
        "USE1-VPCLattice-Service-Hourly",
        "USE1-VPCLattice-DataProcessing-Bytes",
        "USE1-VpcLattice-Service-Network-Resource-Hours",
        "USE1-VpcResource-Consumer-Bytes",
        "USE1-VpcResource-Provider-Bytes",
        "USE1-VpcEndpoint-Resource-Hours"
      ]}}
    ]
  }' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE
# Per-service costs using cost allocation tags
aws ce get-cost-and-usage \
  --time-period Start=2025-05-01,End=2025-06-01 \
  --granularity MONTHLY \
  --metrics "UnblendedCost" \
  --filter '{
    "And": [
      {"Dimensions": {"Key": "SERVICE", "Values": ["Amazon Virtual Private Cloud"]}},
      {"Dimensions": {"Key": "USAGE_TYPE", "Values": [
        "USE1-VPCLattice-Service-Hourly",
        "USE1-VPCLattice-DataProcessing-Bytes",
        "USE1-VpcLattice-Service-Network-Resource-Hours",
        "USE1-VpcResource-Consumer-Bytes",
        "USE1-VpcResource-Provider-Bytes",
        "USE1-VpcEndpoint-Resource-Hours"
      ]}}
    ]
  }' \
  --group-by Type=TAG,Key=ServiceName

Note: These examples cover the most common Lattice Services usage types. Add additional codes from the usage type table above as needed for your specific deployment (e.g., RequestCount-Charged, ConnectionCount-Charged for request-based billing; VpcResource-Consumer-Bytes, VpcResource-Provider-Bytes, VpcEndpoint-Resource-Hours for resource configurations; or ODB variants for on-demand billing).

Part 6: Key Gotchas and Considerations

Issue	Detail
No standalone service filter	VPC Lattice costs are under "Amazon Virtual Private Cloud" — filter by Usage Type to isolate
Inconsistent casing	AWS uses both VPCLattice and VpcLattice in usage type codes — match both
Tag activation delay	New cost allocation tags take ~24h to appear and only apply going forward
Cross-account billing	For Lattice services, charges appear in the service owner’s account (producer), not the consumer’s. For resource configurations, data processing is split: consumer-side bytes (VpcResource-Consumer-Bytes) are billed to the consumer (endpoint owner), provider-side bytes (VpcResource-Provider-Bytes) are billed to the resource owner. Resource endpoint hourly charges (VpcEndpoint-Resource-Hours) are billed to the consumer.
Per-service hourly charge	Each service associated with a service network incurs its own hourly charge (5 services = 5x hourly)
Free tier per service	300K requests/hr per service are included in the hourly charge — won't show as a cost line
Resource configuration costs	Accessing VPC resources (RDS, ElastiCache, etc.) via resource configs has separate tiered data processing charges

Summary

Goal	Approach
See total VPC Lattice spend	Filter: Service = "Amazon Virtual Private Cloud" + Usage Type contains "VPCLattice"
Break down by charge type	Group by Usage Type
Break down by individual service	Tag services → activate cost allocation tags → group by tag