A media company processes 200 TB monthly between VPCs and S3 in one Region, but NAT gateway and cross-AZ charges are spiking. Traffic must stay private without internet egress, prefer same-AZ paths, and avoid inter-Region hops. Which network cost design reduces data transfer spend?

Gateway VPC endpoints for S3 keep traffic on the AWS private backbone without NAT or internet processing charges. Keeping clients and traffic in the same Availability Zone minimizes cross-AZ fees, and the endpoint’s Regional route-table target avoids hourly and per-gigabyte endpoint charges while meeting the requirement to avoid inter-Region transfer. Routing all S3 traffic through NAT gateways adds hourly and per-gigabyte processing costs and uses internet gateway egress paths, increasing the stated cost drivers. Enabling cross-Region replication and serving reads from the farthest Region adds replication and inter-Region transfer costs and conflicts with the requirement to keep traffic in one Region. Deploying Transit Gateway with appliance inspection for same-Region S3 flows adds transfer and inspection overhead when a gateway endpoint can handle that traffic without those costs. Exam caveat: a gateway endpoint is Regional, so AZ-aware subnet and route-table design still matters for avoiding cross-AZ charges. As a practical check, review Cost Explorer transfer charges, VPC Flow Logs, and traffic distribution by AZ before making the change.