Egress is the line item nobody sizes upfront and everyone regrets at month-end. Here's the taxonomy, the surprise bills, and what actually cuts it.
Cloud Egress Costs Explained (and How to Avoid Them)
Compute you size upfront. Storage you can eyeball. Egress is the one that shows up on the invoice as a four-figure surprise, and the first question in the postmortem is always the same: "wait, we pay for that?"
Yes. Every byte that leaves a boundary the provider decided to meter costs money, and the boundaries are not where your architecture diagram says they are. Let's map them.
There are four kinds of data movement worth knowing, roughly in order of how often they bite.
Internet egress. Bytes leaving the cloud to the public internet — API responses, downloads, video. This is the headline number. On AWS it's tiered, landing around $0.05–0.09/GB for most volume after the first free tier. GCP is similar, $0.08–0.12/GB depending on destination continent. Azure sits in the same band, roughly $0.05–0.087/GB. All three give you a small free allowance (AWS bumped the free tier to 100 GB/month a while back) and all three charge nothing for ingress. They want your data in. Getting it out is where the meter runs.
Cross-region. Data moving between regions inside the same provider — say us-east-1 to eu-west-1 for replication. Cheaper than internet but far from free: $0.02/GB on AWS is the number to memorize. GCP and Azure hover in the same $0.02–0.05 range. People forget this one because it's "internal," and internal feels free. It isn't.
Cross-AZ. The quiet killer. Traffic between availability zones inside the same region. AWS charges $0.01/GB each way — so a byte that crosses an AZ boundary and comes back is $0.02/GB round trip. GCP charges around $0.01/GB. Azure historically didn't meter this, then started rolling out AZ transfer charges, so check your region and date. A cent per gig sounds like nothing until a chatty service does it a billion times a day.
Same-AZ. Free on all three, as long as you use private IPs. Route through a public IP or a load balancer and you can lose that exemption, so the free path has fine print.
Four patterns account for most of the shock invoices we've seen.
Chatty cross-AZ microservices. You spread services across three AZs for resilience — good instinct. Then service A in AZ-1 calls service B in AZ-2 forty times per request, and the service mesh load-balances calls round-robin across zones with no locality preference. Every hop is metered both directions. We've watched a single internal API rack up more cross-AZ transfer cost than the EC2 fleet running it.
Cross-region replication. Someone enables S3 cross-region replication or a multi-region database for DR. The steady-state delta is fine; the initial backfill of 40 TB at $0.02/GB is an $800 line item nobody budgeted, and then every write pays the toll forever.
Serving media straight from S3. An app serves images and video directly from a bucket to end users. That's internet egress at full retail, $0.05–0.09/GB, on every view. A moderately popular asset served a few million times becomes a genuinely large number, and you paid it to skip putting a CDN in front.
NAT gateway data processing. This one is nasty because it's a second charge stacked on top. Private-subnet instances reaching the internet or even AWS services through a NAT gateway pay ~$0.045/GB in processing fees on top of any egress. Pull a few terabytes of container images or package downloads through NAT and you're paying premium rates for traffic that never needed to touch the internet.
Put a CDN in front of anything public. CloudFront (or Fastly, or Cloudflare) caches at the edge, so origin egress drops to near zero on cache hits and edge delivery is often cheaper per GB than raw S3 egress anyway. This is the single highest-leverage move for media-heavy apps.
Consider egress-free storage for the origin. Cloudflare R2 charges $0 egress, full stop. For workloads that shovel large volumes out — public datasets, media libraries, backups other clouds read — moving the origin off S3 and onto R2 changes the math entirely. Backblaze B2 plays a similar game. This is the kind of structural decision a broader cloud cost optimization review should be surfacing anyway.
Use VPC endpoints / PrivateLink to dodge NAT. Gateway endpoints for S3 and DynamoDB are free and route that traffic off the NAT path completely — no processing fee, no internet egress. Interface endpoints cost a small hourly rate but kill the per-GB NAT charge for other services. If your NAT bill has a fat data-processing component, this pays for itself in days.
Pin traffic to the same AZ. Topology-aware routing in Kubernetes, zone-aware clients, keeping tightly-coupled services co-located. You lose a sliver of theoretical resilience and gain both lower latency and a smaller bill. Most teams over-index on cross-AZ chatter they never needed.
Compress and cache. gzip/brotli on API responses and static assets cuts bytes on the wire by 60–80% for text. Cache-Control headers that actually let the CDN and browsers hold assets mean fewer origin fetches. Boring, cheap, effective.
A media app we looked at was serving 50 TB/month of images directly from S3 to users, plus 10 TB/month of cross-AZ chatter between services, plus a NAT gateway pushing 5 TB of image pulls.
Before:
- S3 internet egress: 50 TB × ~$0.08 = $4,000
- Cross-AZ transfer: 10 TB × $0.02 = $200
- NAT processing: 5 TB × $0.045 = $225
- Monthly total: ~$4,425
After: CloudFront in front of S3 (85% cache hit rate cuts origin egress to ~7.5 TB, and edge delivery runs ~$0.06/GB), topology-aware routing halving cross-AZ hops, and an S3 gateway endpoint removing the NAT pulls.
- CloudFront delivery: ~$3,000 (and dropping as cache warms)
- Origin egress: ~$0
- Cross-AZ: $100
- NAT processing: $0
- Monthly total: ~$3,100
That's roughly 30% off the transfer bill, and the CDN slice keeps shrinking as you tune cache keys and TTLs.
Egress is an architecture problem wearing a billing costume. You don't fix it with a coupon; you fix it by deciding where bytes are allowed to cross boundaries. Put a CDN in front of everything public, close the NAT-gateway leak with endpoints before you do anything else — it's usually the fastest win — and treat cross-AZ chatter as a design smell, not a fact of life. If a workload is genuinely egress-heavy, look hard at R2-style zero-egress storage before you assume S3 is the only option. Size egress in the design review, not the postmortem.
