title: Is traffic from a VPC EC2 instance with a public IP address to an S3 bucket in the same region guaranteed to stay within Amazon's network?
body: <p>This question is inspired by <a href="https://twitter.com/tveastman/status/1155638640669650944" rel="nofollow noreferrer">this tweet</a> by someone who accidentally and unexpectedly incurred a large bill due to NAT gateway.</p>
  
  <p>I'm using EC2 to process terabytes of data from an S3 bucket. The bucket and the instance are in the same region.</p>
  
  <p>My goal is to minimize costs. In particular, I want to pay $0 for S3 data transfer costs. According to the <a href="https://aws.amazon.com/s3/pricing/#Data_Transfer_pricing" rel="nofollow noreferrer">S3 pricing page</a>, this should be possible:</p>
  
  <blockquote>
    <p>Transfers between S3 buckets or from Amazon S3 to any service(s) within the same AWS Region are free.</p>
  </blockquote>
  
  <p>My instance is in a VPC, has a public IP address, no NAT gateway, no S3 gateway endpoint.</p>
  
  <p>I observe that over months of doing this, I'm <em>not</em> being charged. Whereas <code>traceroute</code> from a server in a different region shows intermediate hops to the S3 host, the route from a server in the same region shows no intermediate hops to the S3 endpoint. Is this always guaranteed? Could Amazon's DNS resolver one day give me an IP address that requires routing over the public Internet, thus incurring thousands of dollars of fees?</p>
  
  <p><a href="https://stackoverflow.com/questions/42695240/if-i-am-downloading-an-s3-object-from-an-ec2-instance-does-this-request-leave-t">This question</a> seems a bit related, but doesn't really address the core question.</p>