What does AWS actually charge for a VPN?
Summary
AWS bills its VPN services by the hour and by the gigabyte, never by the person. In AWS's own US East (Ohio) examples, Client VPN with one endpoint and ten users costs $0.60 for an hour, and a single always-on Site-to-Site connection comes to $523.80 for 30 days, $451.80 of it data transfer. For 50 branch offices, AWS's examples put a VPN Concentrator at $3,967.70 a month against $5,767.70 for 50 separate connections.
Client VPN, for people
The worked example on AWS's pricing page is small on purpose. One Client VPN endpoint in Ohio is associated with one subnet, ten people connect, and they stay on for an hour. The endpoint costs $0.10 for that hour and the ten connections cost $0.50, so $0.60 in total.
The endpoint charge keeps running when nobody is connected. Left associated for a 30-day month, that one endpoint is $72 before anyone logs in. On top of that you pay standard public IPv4 charges for the tunnel addresses and AWS's normal rate for data leaving EC2 for the internet. How much traffic that is depends on whether staff browsing goes through the tunnel at all, which our article on split tunneling covers.
Site-to-Site, for offices
AWS's example for a standard 1.25 Gbps Site-to-Site connection is an office linked through a Transit Gateway in Ohio for 30 days straight, receiving 10 TB and sending 5 TB. The connection is $0.05 an hour, or $36. The Transit Gateway attachment is another $0.05 an hour, another $36. Then data out: the first 100 GB is free and the remaining 5,020 GB is billed at $0.09 per GB, which is $451.80. The month totals $523.80.
So the connection and the attachment together are $72 of a $523.80 bill. Headcount doesn't enter into it: a branch of 10 and a branch of 100 pay the same connection fee if the link is up the same number of hours.
The faster 5 Gbps connection is $0.60 per hour in every Region that supports it, which works out to $432 for a 30-day month.
Fifty branches: Concentrator or separate links?
A Site-to-Site VPN Concentrator is $1.95 an hour, plus $0.01 an hour for each site connected through it. AWS prices out 50 North American sites over 30 days, each receiving 1,000 GB and sending 500 GB:
- Concentrator: $1,404.00
- 50 site connections: $360.00 ($7.20 each)
- One Transit Gateway attachment: $36.00
- Data transfer out: $2,167.70
- Total: $3,967.70
The same 50 sites on 50 separate 1.25 Gbps connections cost $1,800 in connection fees and $1,800 in attachments, with identical data transfer, for $5,767.70. Traffic is the same in both setups, so the $1,800 gap comes entirely from paying for a connection and an attachment per site. Which sites qualify for a Concentrator, and at what bandwidth, is in our piece on VPN routers and concentrators.
Putting it next to per-user prices
None of these figures belongs in a per-seat ranking as is. You can build your own monthly total from endpoints, hours and traffic and divide it by headcount, but the result is your number, not a price AWS publishes.
Sources
- https://aws.amazon.com/vpn/pricing/
- https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html
- https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/split-tunnel-vpn.html
- https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-concentrator.html
Related on this site
- Per user, per device, or per server — the unit is not the same everywhere
- What a business VPN costs per user, at your team size
- What is a VPN tunnel, and does all of your traffic have to go through it?
- Is a VPN router the same thing as a VPN concentrator or VPN passthrough?
- Is VPN as a service just a VPN someone else runs for you?
Written by Kaz (pen name). Published September 28, 2026. The facts above come from the vendor and standards pages listed under Sources. We have not used these products. Corrections: contact form.