Egress cost planning

Use the egress cost estimator for a formula pass. It is not an invoice. The operational path for a sudden jump is cross-region traffic cost.

Assumptions

• You can group billing by usage type or meter, and you can name the path on a diagram (AZ, region, internet, NAT).
• AWS data transfer, Azure bandwidth and Google Cloud egress are in scope. Alibaba CEN bandwidth is on the Alibaba APAC page.
• Published rates differ by path and region. A US-centric calculator is out of scope for APAC pairs.
• This is planning and isolation, not a commitment to a CDN or Private Link SKU.

Name the path before you name the price

Treat each hop as a meter:

Path	Typical AWS line	Typical Azure / Google Cloud analogue
Same AZ, same VPC	Often unbilled for that hop	Same-zone internal traffic is usually cheap or unbilled
Cross-AZ	DataTransfer-Regional-Bytes and related	Inter-AZ or inter-zone data transfer
Cross-region	DataTransfer-Out-Bytes to another region, plus TGW inter-region	Inter-region bandwidth
Internet egress	DataTransfer-Out-Bytes	Internet egress / bandwidth out
NAT processing	NAT-Gateway-Bytes plus hourly	Azure NAT Gateway / Cloud NAT processing
Inspection hop	Firewall or NVA GB processed	Azure Firewall, Cloud NGFW, NVA

AWS NAT gateways charge hourly per AZ and per GB processed, including traffic that later leaves through the internet. Transit Gateway charges per attachment-hour and per GB processed. Those GB charges stack with data-transfer meters. Azure Firewall and a hub NVA do the same stacking.

Google Cloud Shared VPC does not cancel egress. Bytes that leave a region or leave Google still meter. The host project and the service project can split who sees the bill depending on the product. Confirm the billing export, do not assume the host pays everything.

Pull usage types, then interpret them

aws ce get-cost-and-usage \
  --time-period Start=2026-08-01,End=2026-09-01 \
  --granularity MONTHLY \
  --metrics UnblendedCost UsageQuantity \
  --group-by Type=DIMENSION,Key=USAGE_TYPE \
  --filter '{
    "Or": [
      {"Dimensions": {"Key": "SERVICE", "Values": ["AWS Data Transfer"]}},
      {"Dimensions": {"Key": "USAGE_TYPE", "Values": ["NAT-Gateway-Bytes"], "MatchOptions": ["CONTAINS"]}}
    ]
  }'

If that filter is too narrow for your payer, drop it and group the whole month by USAGE_TYPE, then grep the JSON for DataTransfer, NAT-Gateway, TransitGateway and VpcPeering.

Interpretation:

• A large USE1-USE2-AWS-Out-Bytes style usage type is inter-region, not internet. The region codes in the name tell you the path.
• NAT-Gateway-Bytes growing while DataTransfer-Out-Bytes is flat often means spoke-to-spoke or spoke-to-AWS-public-endpoint hairpin through NAT. That is an architecture bug, not “users downloaded more.”
• Hourly NAT or TGW lines growing without GB growth means someone added AZs or attachments, not traffic.

Azure Cost Management: group by Meter subcategory Bandwidth and NAT Gateway. Google Cloud Billing export: network/* SKUs and Cloud NAT. The FinOps Foundation treats this as an allocation problem. You cannot optimize a meter you have not isolated.

Architecture choices that move the meter

Replication across regions is a reliability decision that creates a permanent egress floor. Size it in cross-region disaster recovery before you call the bill a surprise.

Hub-and-spoke with a central NAT concentrates NAT-Gateway-Bytes in the network account. That is easier to read than twelve spoke NATs. It does not reduce GB if the bytes still leave the region. Topology is in hub-and-spoke cloud networking.

Private endpoints and VPC endpoints replace some internet egress with endpoint or Private Link processing charges. Compare both meters. “We went private” is not a cost reduction until you check.

CDN shifts internet egress from the origin to the edge product (CloudFront, Azure Front Door, Cloud CDN). Origin-to-edge bytes can still bill. Compare the CDN pair in CloudFront vs Azure Front Door vs Cloud CDN vs Alibaba Cloud CDN.

Provider-specific traps in APAC

Inter-region rates inside APAC differ from US intra-continent rates. A Tokyo to Singapore path is not priced like Virginia to Ohio. China mainland regions on Alibaba Cloud and the AWS China partition are different billing domains. Do not use a US-centric calculator for ap-southeast-1 or asia-southeast1 without opening that region’s price page.

Google Cloud premium versus standard network tiers change internet egress rates. Azure availability-zone transfer is a separate line from inter-region. Read the current bandwidth page for the region you run.

Risks and limitations

Cost Explorer and Azure Cost Management can lag usage by a day or more. They also use amortized or unblended views that disagree with the invoice. Say which metric you used.

Usage-type names change. CONTAINS filters rot. Re-list usage types each quarter.

The estimator on this site applies published-style formulas. It does not include taxes, EDPs, committed-use discounts or every Private Link SKU. Native price lists remain the source.

If NAT GB is the line that moved, use NAT gateway cost increase before you delete a gateway that is the only egress path.