Use this runbook when the line that moved is data transfer, bandwidth, inter-region egress or a similar meter, not compute hours. First action: group cost by usage type and region pair for the spike window, then list replication, backup, peering and failover jobs that run across regions. Do not fail traffic back or delete a peering to save money during an active DR event. Inter-AZ, inter-region and internet egress are priced differently. Name which of those three you are on before you change the topology.

Match the meter to a path. The bill will not tell you if the copy was a DR test, an artifact pull or a replica you forgot. Background: egress cost planning and cross-region disaster recovery.

Symptoms

Data-transfer, bandwidth or inter-region SKU lines rise while compute is flat. Flow logs show sustained bytes to another region CIDR or to a public endpoint in another region. Object-storage replication, snapshot copy, image pulls or analytics exports appear in the same window. A failover drill or a “temporary” replica was left running. If NAT processing rose too, continue with NAT gateway cost increase.

Business impact

Inter-region and internet egress are usually the expensive networking meters. A full-database copy or a large bucket sync can consume the monthly network budget in a day. Cutting production replication to save money can break the RPO you already promised.

Immediate checks

  1. Split the bill into inter-AZ, inter-region and internet. Those are different prices on each provider’s public price page.
  2. List region pairs in use (for example ap-southeast-1 to ap-southeast-2, or southeastasia to australiaeast).
  3. List managed replication: RDS/Aurora, Cloud SQL, Azure SQL geo-replication, object-storage replication, snapshot copy, container-registry geo-replication.
  4. List human jobs: rsync, warehouse unload, CI cache, model-artifact copy.
  5. Check whether a failover or Traffic Manager / Route 53 change sent users to a far region.

Provider commands and console paths

AWS. Cost Explorer, group by Usage type and Region. Inter-region and internet transfer appear as EC2, S3 or other service usage types. Confirm current published rates on EC2 on-demand data transfer.

aws ce get-cost-and-usage \
  --time-period Start=START,End=END \
  --granularity DAILY \
  --metrics UnblendedCost UsageQuantity \
  --group-by Type=DIMENSION,Key=USAGE_TYPE

Inventory paths:

aws ec2 describe-vpc-peering-connections
aws ec2 describe-transit-gateways
aws s3api get-bucket-replication --bucket BUCKET

Azure. Cost analysis, group by Meter subcategory or Meter. Filter Bandwidth. Published rates: Bandwidth pricing.

az network vnet peering list --resource-group RG --vnet-name VNET

Storage replication: Storage account, object replication or geo-redundant settings in the portal. Do not assume GRS is the same cost as LRS; read the storage redundancy docs for the account.

Google Cloud. Billing reports, group by SKU, filter Network. Published rates: VPC network pricing.

gcloud compute networks peerings list
gcloud compute vpn-tunnels list
gcloud storage buckets describe gs://BUCKET --format='yaml(name,location,rpo,updateTime)'

Alibaba Cloud. Expenses and Costs, Bill Details, filter network and traffic products. Published rules: ECS public bandwidth and CDT internet transfers. For peering and CEN, use the VPC and Cloud Enterprise Network consoles rather than guessed CLI flags.

Interpretation

Sustained, even bytes between two regions: replication or a live dual-region active path.

A single steep ramp then a flat line: a one-off copy (migration, snapshot, warehouse export).

Bytes to 0.0.0.0/0 or a public API in another region: the app is using a public endpoint instead of a local one. That can also hit NAT.

User traffic after failover: expected if you invoked DR. Cost is the price of the RTO you configured. It is not an incident by itself.

Inter-AZ-only growth: still a bill, but a different price list. Do not apply inter-region advice to AZ traffic.

Safe mitigation

Pause non-production replication and CI caches that cross regions. Keep production replicas if they are in the DR design. Point artifact pulls at a registry or bucket in the same region, on a private endpoint. If a failover drill is over, fail back through region failover. Finish or cancel one-off copies; do not leave a parallel sync running.

Risky actions to avoid

Do not delete VPC peering, Transit Gateway attachments, VNet peering or CEN bandwidth packages to “stop the traffic.” You will drop the control path and possibly the data path.

Do not turn off geo-redundant storage or database replication to save a day’s bill without an RPO decision in writing.

Do not invent a “free” cross-region path. Provider price pages list inter-region transfer. If a SKU looks free, read the footnote.

Do not quote a dollar-per-GB figure from memory. Open the current price page for the two regions you actually use.

Validation

Re-run the usage-type grouping the next complete day. Inter-region quantity should flatten if you paused the copy. Confirm reads still hit the local region. If you kept DR replication, confirm lag still meets the recorded RPO. The egress cost estimator is a formula check, not an invoice.

Prevention

  1. Record allowed region pairs in the architecture decision record. A second region that is not in the ADR is an unowned egress path.
  2. Charge inter-region traffic to the team that owns the replica or the cross-region call.
  3. Prefer in-region multi-AZ when the RTO allows it. Keep a second region for disaster recovery, not for CI artifact pulls.
  4. Alert on inter-region and intercontinental meters, not only on the monthly invoice. Amounts change by region pair; read the current price list.
  5. Point registries and object stores at the same region on a private endpoint when the workload allows it.

Official sources