4 of the 7 questions we have for this objective, shown with the answer and the reasoning.
Design cost-optimized network architectures
Quillon Payments operates a microservices platform of about 80 services on EC2 instances spread evenly across three Availability Zones in us-east-1. The monthly bill shows a rapidly growing charge under the usage type DataTransfer-Regional-Bytes that now exceeds the NAT gateway and internet egress charges combined, but nobody knows which services are responsible. The company wants to identify the source of the charge and reduce it without changing the number of Availability Zones used for resilience.
What should a solutions architect do?
- ACreate interface VPC endpoints for Amazon EC2 and Amazon CloudWatch in every subnet to keep traffic private.DataTransfer-Regional-Bytes is traffic between Availability Zones inside the Region; it is not caused by calls to public service endpoints, so interface endpoints add cost without reducing the charge.
- BEnable VPC Flow Logs delivered to Amazon S3, query them with Amazon Athena to rank source and destination pairs by bytes crossing Availability Zones, then configure the chattiest service pairs to prefer targets in the same Availability Zone.Flow logs record bytes per source and destination interface, so joining them with each interface's Availability Zone pinpoints which service-to-service paths generate cross-AZ traffic; keeping those calls zone-local, for example with zone-aware service discovery or target selection, removes the per-GB charge while all three zones stay in use.
- CPurchase a Compute Savings Plan to cover the data transfer charge.Savings Plans discount compute usage only; they do not apply to any data transfer usage type.
- DEnable AWS Global Accelerator for the platform's load balancers to route traffic over the AWS backbone.Global Accelerator affects how internet clients reach the platform; the charge in question is internal traffic between Availability Zones and is unaffected.
Why: Reviewing an existing workload for network cost starts with reading the usage type on the bill: DataTransfer-Regional-Bytes means cross-Availability-Zone traffic within a Region, which is billed per GB in each direction and is easy to accumulate when microservices call each other without regard to zone. VPC Flow Logs provide the per-interface byte counts needed to attribute that traffic, and Athena makes the aggregation straightforward. The fix is to make high-volume service calls zone-aware so that the same resilient three-zone layout still exists but most traffic stays local. The trap is reaching for tools that address other cost lines, such as endpoints for NAT charges, Savings Plans for compute, or Global Accelerator for internet ingress, none of which touch cross-AZ transfer.
Design cost-optimized network architectures
Lumen Street Apparel serves product images and CSS files for its online store directly from a public S3 bucket named lumen-static-assets in eu-west-1. Customers are spread across Europe, North America, and Asia, and the bucket delivers about 250 TB of data to the internet each month. Finance has flagged the S3 data transfer out charge, and the marketing team also wants faster page loads for customers in Asia.
Which solution will meet these requirements MOST cost-effectively?
- AEnable S3 Transfer Acceleration on the bucket.Transfer Acceleration speeds up uploads and downloads of individual objects over long distances but adds a per-GB charge on top of data transfer and does not cache anything.
- BReplicate the bucket to us-east-1 and ap-southeast-1 and route users to the nearest Region with Amazon Route 53 latency-based routing.Cross-Region replication triples storage, adds inter-Region transfer charges for every object, and still bills data transfer out to the internet from each Region at the S3 rate.
- CCreate an Amazon CloudFront distribution with the S3 bucket as the origin and serve the assets through CloudFront.Data transfer from S3 to CloudFront is free, CloudFront's per-GB internet egress price is lower than S3's, and edge caching means most requests never reach the origin while customers in every geography are served from a nearby edge location.
- DDeploy AWS Global Accelerator with the S3 bucket as an endpoint.Global Accelerator accelerates TCP and UDP traffic to load balancers, EC2 instances, and Elastic IPs; it does not support S3 as an endpoint and does not cache content.
Why: A CDN is the strategic answer whenever a workload serves the same static content to many internet users: CloudFront caches objects at edge locations, which reduces origin load and latency, and its egress pricing is lower than S3 or EC2 data transfer out, while origin fetches from S3 are not charged. The deciding constraints are high internet egress volume, globally distributed users, and a latency complaint, all of which CloudFront addresses in one change with no application rewrite. Replicating buckets across Regions solves latency but multiplies cost. The trap is Global Accelerator, which optimizes network paths for dynamic application endpoints but neither caches content nor works with S3 origins.
Design cost-optimized network architectures
Stanmore Imaging must replicate about 4 TB of new scan data from its on-premises storage to an S3 bucket in eu-central-1 every night within a 6-hour window, which works out to a sustained rate of roughly 1.5 Gbps. The company currently uses a single AWS Site-to-Site VPN connection terminated on a virtual private gateway, and the transfers regularly overrun the window. The data center has a 10 Gbps internet connection with spare capacity, and the company wants the cheapest change that reliably meets the window.
Which solution will meet these requirements MOST cost-effectively?
- AReplace the virtual private gateway with an AWS Transit Gateway, create two Site-to-Site VPN connections to it, and enable equal-cost multipath routing so the transfer is spread across all tunnels.Each VPN tunnel is limited to 1.25 Gbps, so a single connection cannot sustain 1.5 Gbps; Transit Gateway supports ECMP across multiple VPN connections, which aggregates tunnel bandwidth for a few extra dollars per hour and uses the internet capacity the company already has.
- BOrder a 10 Gbps AWS Direct Connect dedicated connection and migrate the replication to it.A 10 Gbps dedicated port costs far more per month than two VPN connections, takes weeks to provision, and provides roughly seven times the bandwidth actually required.
- CKeep the single VPN connection and enable S3 Transfer Acceleration on the destination bucket.Transfer Acceleration uses CloudFront edge locations over the public internet; traffic through the VPN tunnel is still capped at 1.25 Gbps per tunnel, and the acceleration charge adds cost.
- DOrder a 1 Gbps AWS Direct Connect dedicated connection and keep the VPN as a backup.A 1 Gbps connection cannot carry a sustained 1.5 Gbps replication stream, so the nightly window would still be missed despite the added monthly port cost.
Why: Bandwidth sizing starts from the required sustained rate, here 4 TB in 6 hours or about 1.5 Gbps, and then compares it with the limits of each option: a Site-to-Site VPN tunnel tops out at 1.25 Gbps, a virtual private gateway cannot load-balance across tunnels, and Direct Connect dedicated ports come in 1, 10, 100, and 400 Gbps. When the requirement sits between a single tunnel and a 10 Gbps port, Transit Gateway with ECMP across several VPN connections is the lowest-cost way to aggregate throughput, especially since data transferred into AWS is free on both VPN and Direct Connect. The deciding constraints are the modest overage above one tunnel, existing internet headroom, and lowest cost. The trap is buying a Direct Connect port sized either too small to work or far larger than the workload needs.
Design cost-optimized network architectures
Pembrook Weather exposes a forecast API through Amazon API Gateway backed by AWS Lambda functions that query Amazon DynamoDB. The API is offered to 200 partners on a free tier limited to 10,000 requests per day, but last month one partner's misconfigured client sent 40 million requests in a weekend, which drove Lambda and DynamoDB on-demand charges to ten times the normal level. The company wants to enforce the per-partner limit and cap the worst-case backend cost without rewriting the application.
Which two actions should a solutions architect take? Each correct answer presents part of the solution.
- AIncrease the Lambda function memory so each invocation finishes faster and costs less.Faster invocations may lower per-request cost slightly but do nothing to limit the number of requests a runaway client can generate.
- BEnable AWS Shield Advanced on the API to block the partner's traffic.Shield Advanced protects against DDoS attacks for a significant monthly fee; legitimate but excessive calls from an authenticated partner are a quota problem, not a DDoS problem.
- CCreate an API Gateway usage plan with a daily quota of 10,000 requests and a per-second rate limit, and require each partner to use its own API key associated with the plan.Usage plans enforce per-key quotas and request rates at the API Gateway layer, so excess requests are rejected with a 429 response before any Lambda invocation or DynamoDB read is billed.
- DMove the DynamoDB table to provisioned capacity with no auto scaling so that writes fail when capacity is exceeded.Deliberately under-provisioning the table throttles every partner, including well-behaved ones, and still allows the Lambda invocations to be billed before they are throttled.
- EConfigure reserved concurrency on the Lambda function to cap the maximum number of concurrent executions.Reserved concurrency sets a hard ceiling on how many instances of the function can run at once, which bounds the worst-case Lambda and downstream DynamoDB spend even if a limit is misconfigured upstream.
Why: A throttling strategy is cheapest when it rejects excess traffic as early in the request path as possible: API Gateway usage plans with API keys enforce per-client quotas and rates before any pay-per-use backend is invoked, and Lambda reserved concurrency provides a second, absolute ceiling on backend spend. Together they stop one client from consuming the budget of all others while still serving legitimate traffic. The deciding constraints are per-partner limits and a hard cap on worst-case cost with no application changes. The trap is throttling at the wrong layer, such as under-provisioning the database, which penalizes every caller and still bills the compute that ran before the throttle.