The egress fee trap

Cloud pricing is asymmetric in a way that catches people out. Uploading data is generally free. Downloading it, or serving it to users, is generally not. And because egress is billed per gigabyte at rates that look small, the total arrives as a surprise rather than as a series of noticeable charges.

For media-heavy sites, data-intensive applications and anything doing large-scale replication, egress can be the single largest line item.

Where egress is charged

Not all outbound traffic is billed the same way, and the distinctions matter.

To the internet. The main charge. Serving pages, images, video, API responses and file downloads to users all count. Usually tiered, with the per-gigabyte rate falling as volume rises, and usually a small free allowance each month.

Between regions. Replicating a database across regions, or serving from one region resources stored in another, is billed. This is the charge that surprises people building for resilience, because the architecture looks sensible and the bill does not.

Between availability zones. Often billed, sometimes in both directions. A chatty microservice architecture spread across zones for redundancy can generate a substantial internal transfer bill purely from services talking to each other.

To other clouds or on-premises. Billed as internet egress unless a dedicated interconnect is in place, and dedicated interconnects have their own costs.

Within a zone, over private addresses. Usually free. This is why keeping chatty components close together matters.

The architectures that generate surprising bills

Some patterns reliably produce large egress charges, and they are all things people do for good reasons.

Serving media directly from object storage. Every view of every image or video is billed egress. This is the classic case and the one a CDN fixes almost entirely.

Cross-zone chatter. Services deliberately spread across zones for availability, calling each other constantly. Each call crosses a billed boundary.

Cross-region database replication. Every write is shipped, continuously, forever.

Backups written out of the cloud. Nightly full backups to an external destination are nightly full egress.

Log shipping to a third-party platform. Verbose logs sent to an external service are a steady, invisible outbound stream that grows with traffic.

Data science pulling datasets down. A team repeatedly downloading large datasets to laptops generates egress every time, and nobody thinks of it as infrastructure usage.

What actually reduces it

In rough order of effectiveness for a typical workload:

Put a CDN in front of anything cacheable. This is the single largest lever for content-heavy sites. Traffic from CDN edge to user is priced differently and usually far more cheaply than origin egress, and the origin only serves cache misses. For media-heavy sites the reduction is frequently ninety percent or more.

Compress everything. Text-based responses compress dramatically. Modern compression on JSON, HTML, CSS and JavaScript often cuts transferred bytes by two thirds, and it is a configuration change.

Right-size images and video. Serving a large image scaled down in the browser bills for the full size. Modern formats and appropriately sized variants reduce the same visual result to a fraction of the bytes.

Keep chatty components in one zone. Redundancy across zones is valuable, but chatty internal services do not each need to be spread if the overall system is redundant. Consider which calls genuinely cross zones and whether they need to.

Cache aggressively at every layer. A response served from cache is not egress.

Reduce log verbosity and sample. Debug-level logging shipped externally in production is a large, avoidable stream.

Keep backups inside the same provider unless you specifically need off-provider copies for resilience against provider failure, which is a legitimate reason to accept the cost.

Providers that price it differently

Not every provider meters egress per gigabyte. Several include a substantial monthly transfer allowance with each plan, often pooled across the account, with modest overage rates beyond it.

For bandwidth-heavy workloads this difference can exceed every other cost consideration combined. A workload serving many terabytes monthly may find the compute price almost irrelevant next to how transfer is billed.

If your bill is dominated by data transfer rather than compute, the most valuable comparison you can do is not instance price but transfer pricing, and it is worth modelling explicitly before assuming the provider you are on is the right one.

Working out what you are actually paying

Group your bill by usage type and look specifically for the transfer categories. They will be separated by direction and by boundary, which tells you whether the cost is internet-facing, cross-region or cross-zone.

That distinction determines the fix. Internet egress is a CDN and compression problem. Cross-zone is an architecture problem. Cross-region is a replication design problem. They are not interchangeable, and applying the wrong remedy achieves nothing.

If you are weighing providers rather than techniques, our cloud account catalogue lists what each one is strongest at, alongside the configurations available.

For the vendor’s own reference on the services involved here, see the AWS documentation.

Putting any of this into practice needs an account to work in. We stock AWS accounts in sixteen configurations, and the cloud account catalogue sets them beside nine other providers.

Questions people ask