I incurred high data transfer charges for Amazon Simple Storage Service (Amazon S3). I want to identify the buckets that caused the high data transfer charges.
Short description
You pay for all the bandwidth into and out of Amazon S3, except for the following data:
- Data that you transfer out to the internet for the first 100 GB per month
Note: This is aggregated across all AWS services and AWS Regions except Amazon Web Services in China and AWS GovCloud (US).
- Data that you transfer in from the internet
- Data that you transfer between S3 buckets in the same Region
- Data that you transfer from an S3 bucket to any service within the same Region as the S3 bucket
Note: This includes data that you transfer to a different AWS account in the same Region.
- Data that you transfer out to Amazon CloudFront
For more information, see Understanding data transfer charges.
Resolution
Check AWS usage report
To identify the buckets that are responsible for high data transfer, check your Amazon S3 usage report. You can check the operation, Region, and time when the data transfer occurred.
To identify the usage types that correspond to data transfer, see Understanding your AWS billing and usage reports for Amazon S3.
Note: In the usage report, Amazon S3 logs data transfer charges as region-DataTransfer-Out-Bytes and region-DataTransfer-In-Bytes.
Review server access logs
For detailed information about the requests, review the Amazon S3 server access logs for the buckets.
Note: The logs begin to record requests only when you turn on server access logs for a bucket.
You can use Amazon Athena to query the server access logs for request information about a specific date and time, operations, and requesters.
For example, run the following query to view the amount of data that you transferred through a specific IP address within a specific period:
SELECT
SUM(bytessent) as uploadtotal,
SUM(objectsize) as downloadtotal,
SUM(bytessent + objectsize) AS total
FROM s3_access_logs_db.mybucket_logs
WHERE remote_ip = '1.2.3.4'
AND time BETWEEN
parse_datetime('2025-07-01 00:00:00','yyyy-MM-dd HH:mm:ss')
AND parse_datetime('2025-08-01 00:00:00','yyyy-MM-dd HH:mm:ss');
For more information, see How do I use Athena to analyze my Amazon S3 server access logs? and Amazon Athena pricing.
Get billing information from monitoring tools
Use the following monitoring tools to get billing information: