- Newest
- Most votes
- Most comments
Regarding your last comment: The reason your calculation is missing the $200+ gap comes down to a critical detail in how AWS bills Client VPN endpoint associations:
You are being billed per hour, per associated subnet, not just a flat fee for the endpoint itself.
The Missing Piece of the Equation:
- Subnet Associations Multiplier: Every subnet you associate with your Client VPN endpoint incurs the hourly endpoint fee independently. If your endpoint is associated with multiple subnets (e.g., 2 subnets across different Availability Zones for high availability), AWS charges you for two endpoint streams simultaneously 24/7.
- Regional Pricing: In regions like Asia Pacific (Sydney), the endpoint association rate is significantly higher than in US regions (often reaching $0.15 to $0.30+ per hour per subnet association).
- Calculation check: 2 subnets $\times$ ~$0.23/hr $\times$ 744 hours in a 31-day month $\approx$ $340+/month, which matches your exact invoice.
Unlike a NAT Gateway or a Site-to-Site VPN connection, the AWS Client VPN billing meter runs continuously based on network footprint (associated subnets) plus active user connection hours, regardless of traffic volume.
How to lower this cost:
- Reduce Subnet Associations: If you don't need multi-AZ redundancy for your VPN, disassociate extra subnets so you are only paying for a single subnet association.
- Automation: If the VPN is only used during business hours, script the detachment of subnets outside of work hours (though note that users cannot connect while subnets are disassociated).
For official reference on how endpoint association hours scale with subnets, see: https://aws.amazon.com/vpn/pricing/
I've found a clue - we have a disagreement about how many hours there are in month.
I believe there are 24 hours in a day, so in a 31-day month there would be 744 hours (24 x 31) But I notice in the Cost Explorer we were charged for 2232 APS2-ClientVPN-EndpointHours in June.
So, it seems that instead of being charged for every hour "that your connection is provisioned and available" as per the AWS pricing documentation https://aws.amazon.com/vpn/pricing/, we are actually being charged for every hour that every connection is made from the client end. i.e. If you make multiple simultaneous connections you're changed for each one.
If this what AWS actually mean, I can make sense of there being 2232 hours in a month because we have 2 locations connected 24/7 (1488 hours) plus 3 remote connections averaging 8 hours/day Mon-Fri (approx. 500 hours). So I can get to almost 2000 hours calculating it this way.
But this means that we're being charged $0.15/hour for each of these APS2-ClientVPN-EndpointHours and I can't find that pricing anywhere.
So who knows? You need to be some sort of savant to work out how AWS create their charges and we're not in a position to change things at the moment, so I guess we just pay the $500/month for the VPN and shut up about it.
The APS2-ClientVPN-EndpointHours charge is calculated based on the hourly fee for maintaining an active AWS Client VPN endpoint, regardless of how much it's used. This is separate from NAT Gateway pricing.
For AWS Client VPN, you are charged two components:
-
AWS Client VPN endpoint hourly fee: This is charged for each hour the endpoint exists and remains active, regardless of whether anyone is connected to it. The rate varies by region - for example, in US East (Ohio) it's $0.10 per hour.
-
AWS Client VPN connection hourly fee: This is charged separately for each active client connection (which appears to be your $27 APS2-ClientVPN-ConnectionHours charge).
The $335/month for endpoint hours suggests you're being charged approximately $0.45-$0.46 per hour for your Client VPN endpoint in the Asia Pacific (Sydney) region, running 24/7 for about 730 hours per month. This rate is significantly higher than some other regions.
The confusion seems to stem from comparing Client VPN pricing with NAT Gateway pricing - these are completely different services with different pricing structures. NAT Gateway allows outbound internet access from private subnets, while Client VPN provides secure remote access for users to connect to your VPC resources.
To reduce your Client VPN costs, you could consider:
- Deleting the endpoint when not needed (if usage is predictable)
- Reviewing whether you need Client VPN or if another solution like Site-to-Site VPN might be more cost-effective for your use case
- Checking if you have multiple endpoints running that could be consolidated
Sources
AWS VPN Pricing - Cloud VPN - Amazon Web Services
So according to https://aws.amazon.com/vpn/pricing/ we also pay $0.05 per Site-to-Site VPN connection per hour. So that accounts for $37.20 in a 31 day month. We're still a long way from $335.00
Relevant content
asked 4 years ago
asked 11 years ago
asked 3 years ago
- AWS OFFICIALUpdated 3 years ago
Thanks Florian. I've looked into scripting the detachment of subnets outside of work hours and it seems complicated and likely to introduce a new set of problems. Since we're being charged on hourly basis by AWS for a service, it would be nice if AWS provided a native tool to turn it on and off as needed.