Compute and storage get the attention in cost reviews because you can point at an instance or a bucket. Data transfer is harder to see. The charge appears on a network resource such as a NAT gateway, while the decision that caused it was made by a workload: a service calling a dependency in another zone, a job pulling images through a shared gateway, a replication setting someone enabled two years ago. That gap between where the bill lands and who caused it is why egress survives most cost-optimization efforts.

This guide covers how the three major providers charge for data movement, where the surprises hide, and a repeatable audit process. Every price below was published on the vendor’s pricing page when this was written, and pricing changes without much notice, so confirm current figures before you put numbers in a business case.

Egress is several charges, not one

Teams often say “egress” and mean only traffic to the public internet. Real bills contain at least four separate categories:

  1. Internet egress. Data leaving the provider’s network to users or other networks.
  2. Cross-region transfer. Replication, backups, and multi-region architectures.
  3. Cross-zone transfer inside a region. Chatty microservices spread across availability zones.
  4. Gateway processing fees. Per-GB charges for passing traffic through NAT gateways, load balancers, and similar services, layered on top of the transfer charge itself.

The fourth category is the one that most often surprises engineers, because it applies even when the traffic never leaves the provider.

What the providers publish

AWS

AWS states that customers receive 100 GB of free data transfer out to the internet each month, aggregated across services and regions, with exceptions for China and GovCloud. Beyond that allowance, the widely published first-tier internet rate is $0.09 per GB, dropping at higher volume tiers. Verify the rate table for your region on the EC2 on-demand pricing page.

The VPC pricing page lists NAT gateway pricing at $0.045 per hour plus $0.045 per GB processed (the figure shown for US East, Ohio). It also notes that standard data transfer charges still apply to traffic through the gateway, that traffic between a NAT gateway and an instance in a different availability zone is charged, and that Gateway-type VPC endpoints for S3 carry no data processing or hourly charge. Put those together and an instance sending data to the internet through a NAT gateway pays both the processing fee and the internet transfer rate. Traffic to S3 through a NAT gateway is the classic avoidable case, since the gateway endpoint removes the processing charge entirely.

Azure

Azure’s bandwidth pricing page lists the first 100 GB per month of internet egress as free in North America and Europe. Beyond that, the next tier is listed at $0.087 per GB over the Microsoft premium network or $0.08 per GB via ISP transit routing. Transfer within the same availability zone is free, inter-region transfer within a continent is listed at $0.02 per GB, and transfer from North America or Europe to other continents at $0.05 per GB. Note the routing-preference option: choosing ISP transit instead of the premium network is a real lever, but it changes network path characteristics, so test latency-sensitive workloads first.

Google Cloud

Google Cloud NAT is documented on its pricing page with a data processing charge per GiB on top of destination-based network charges. Traffic between zones in a region is commonly listed at $0.01 per GB in each direction, with only same-zone traffic over internal addresses free. Check the current network pricing tables directly, because tier and destination rules vary.

The pattern is consistent: free tiers cover hobby-scale traffic, cross-zone and cross-region movement carries a per-GB fee, and gateways add their own.

Where the money actually goes

In production estates, the largest egress line items are rarely user downloads. Look here first:

  • NAT gateway processing. Private subnets pulling container images, OS updates, and package dependencies through a shared gateway.
  • Cross-zone microservice traffic. A Kubernetes service load-balancing across zones by default sends a share of requests across a billed boundary. Topology-aware routing can reduce this, at some cost to load distribution.
  • Observability pipelines. Shipping logs, metrics, and traces to a SaaS backend in another region or provider.
  • Cross-region replication and backups. Sensible for resilience, but often configured once and never reviewed.
  • Data egress to analytics platforms. Nightly exports to a warehouse in another cloud.

Treat these as hypotheses to test against your own bill, not as a ranking. Your top line item may be different.

A repeatable audit

Step 1: Get line-item billing data

Turn on the provider’s detailed billing export (AWS Cost and Usage Report, Azure cost exports, Google Cloud billing export to BigQuery) so you can query by usage type instead of reading summary dashboards.

Step 2: Isolate transfer usage types

Filter for data transfer and NAT usage types. Group by account, region, resource ID, and usage type. Rank the top ten. In most audits, the top three items account for the bulk of the spend.

Step 3: Attribute traffic to workloads

Billing tells you which gateway or interface carried the bytes, not which application caused them. Close the gap with flow logs (VPC flow logs or the equivalent), container-level network metrics, or a network observability tool. Map the biggest flows to service owners.

Step 4: Classify each flow

For each large flow, ask whether it is necessary, avoidable, or reroutable. Necessary flows, such as customer downloads, can still be reduced through caching or a CDN. Avoidable flows include unneeded cross-zone calls and images pulled repeatedly from outside the network. Reroutable flows can move to a private endpoint or a cheaper path.

Step 5: Apply the standard fixes

  • Add gateway endpoints for object storage to remove NAT processing on that traffic.
  • Use a pull-through cache or in-region registry for container images.
  • Co-locate chatty services in the same zone where resilience requirements allow, and use topology-aware routing in Kubernetes.
  • Put a CDN in front of cacheable public content, and compare its egress pricing against direct delivery for your traffic mix.
  • Compress and batch telemetry, and keep the collector in the same region as the sources.
  • Review replication schedules and retention against actual recovery requirements.

Step 6: Make it recurring

Set a monthly review with a named owner. Track transfer cost as a share of total spend and per unit of business output, such as cost per thousand requests. Add a budget alert on data transfer usage types, and require an egress estimate in architecture reviews for any design that moves data across zones, regions, or providers.

A note on switching costs

Egress fees also work as lock-in. Regulation is starting to change that in Europe: the EU Data Act prohibits cloud switching charges, egress included, from 12 January 2027, after which providers can no longer bill for moving data out when a customer switches. Contracts do not necessarily update themselves, so review the terms before assuming savings, and note that the rule targets switching between providers, not routine inter-region transfer.

The takeaway

You cannot optimize what you cannot attribute. Start with one billing export, one ranked list of transfer usage types, and one conversation with the owner of the top flow. Most teams find at least one large, avoidable path in the first pass, and the recurring review keeps the next one from growing unnoticed.