They charge you for everything. Data transfer in: charge, data transfer out: charge, DNS lookup: charge, storing a file: charge, etc.
It's one of those situations where it's a death by a thousand cuts. When you're cost provisioning, you can figure out the big stuff, i.e., we need 25 EC2s m4a.2xlarge instances with 40TB of S3 storage, and a 2TB Aurora instance. But once you get the bill, you start seeing the costs of ELBs, NAT gateways, inter-region transfers, etc. Individually, these costs aren't significant, but in aggregate, they can make up a health chunk of your monthly bill.
Plus, their managed solutions are fucking expensive. We moved a self-managed ELK cluster to an AWS-managed one and the costs went up by a factor of two.