Network In greater than Network Out?
Solution 1:
Part of your inbound traffic in is a heartbeat check from AWS management.
Edit:
I've done some looking, and I've found that AWS sends metadata to the instance.
In powershell (v3) you can use Invoke-WebRequest http://169.254.169.254/latest/meta-data/ to examine it. I'm guessing that some of this data is gotten by requests from a service running on the instance to AWS.