Data egress cost control: architectural and contractual levers.

01 Key findings

1. Egress is a pure friction cost. Unlike compute and storage, which buy capacity you use, egress charges you to move your own data. Its second job is to raise the cost of multi-cloud and of leaving — which is why it sits at the center of cloud lock-in.

2. The bill is highly concentrated. In most estates the top three data flows account for more than 70% of the egress bill — usually backups crossing regions, analytics pulling from another provider, or media served without a CDN. A focused fix on those three captures most of the saving.

3. Same-region, cross-zone traffic is the quiet surprise. It is small per GB but enormous in aggregate for chatty distributed apps. A poorly placed replica talking across zones can cost more than the application's external traffic.

4. Free-egress-on-exit is narrower than the headline. The 2024 waivers cover a complete departure on request within a defined window; they do not touch the day-to-day multi-cloud transfer that drives the bill.

5. Architecture cuts volume; the contract cuts the rate. CDNs, colocation and in-region processing reduce the bytes that move; egress waivers, committed-egress discounts and private interconnect reduce what each byte costs.

02 How egress is priced

All three major providers price egress in tiers that fall as volume rises, with internet egress charged per GB after a small monthly free allowance and inter-region transfer charged separately. The headline rates are similar; the detail that matters is what is free and what is not.

The line that surprises buyers is same-region cross-zone traffic — small per GB but enormous in aggregate. Understanding these paths is the first step to controlling them; the negotiation specifics are in cloud egress negotiation and the broader exit economics in cloud exit strategy.

03 The egress-surprise trap

Most egress cost comes from a handful of high-volume paths, not from broad usage, and the paths that dominate are rarely the ones anyone expected.

These flows escape scrutiny because they are owned by infrastructure and resilience teams whose mandate is uptime, not cost. A nightly cross-region copy that satisfies a recovery requirement is a success by that team's metric even when it quietly generates the largest egress line on the invoice. Bringing resilience and FinOps together to right-size replication against the actual recovery objective is what closes the gap without weakening resilience.

04 Egress cost at scale

The per-GB rate you pay is set almost entirely by the path the data takes. Routing the same bytes through a cheaper path — a CDN edge, an in-region hop, or a private circuit — is where the largest savings live. Representative per-GB list rates by path:

05 Architectural controls

Architecture reduces the volume before the contract touches the rate. Four moves cut egress at the source; each maps to a specific, measurable saving rather than a platform-wide redesign.

These are standard cost-optimization practice, covered alongside compute and storage rightsizing in cloud cost optimization.

06 Contract controls

Architecture reduces the volume; the contract reduces the rate. The terms worth securing are an egress waiver or allowance tied to committed spend, committed-egress discounts for predictable high-volume paths, and a private interconnect or direct-connect arrangement that prices dedicated bandwidth below metered internet egress. These are negotiable — especially when egress is a meaningful share of a large commitment — and should be set at a new deal or renewal, when you hold the advantage. The approach is in cloud egress negotiation and the FinOps framing in cloud FinOps negotiation.

For predictable, high-volume flows, a private interconnect turns a variable cost into a fixed one: a monthly port fee plus a reduced per-GB rate. The economics favor it once steady volume passes the point where metered internet egress on a path would exceed the circuit's fixed cost, with predictable performance as a bonus. Revisit the analysis as volume grows — the interconnect and committed-egress terms are part of egress negotiation and the cloud renewal strategy.

07 Backup, DR & retrieval

Backup and disaster recovery are the largest hidden egress drivers in most enterprises, because they move large volumes across regions on a schedule and rarely surface in the cost conversation. A cross-region backup copying terabytes nightly generates inter-region charges every night; a DR replica streaming changes to a second region runs continuously. The fixes are specific: keep backups in-region where the resilience requirement allows, use the provider's own backup service which often carries reduced or waived transfer, compress and deduplicate before transfer, and right-size replication frequency to the actual recovery objective rather than the most aggressive default. For an estate moving tens of terabytes a month, these changes commonly remove $20,000 to $60,000 a year of egress.

Archival storage tiers add retrieval fees that behave the same way. Cold and archive tiers price storage cheaply but charge a per-GB retrieval fee and sometimes a minimum storage duration, so data retrieved sooner or more often than expected can cost more than if it had stayed in standard storage — and retrieval fees compound with egress when retrieved data is then moved out of the region. Match the tier to the real access pattern, and model the full lifecycle cost — storage plus retrieval plus egress — not the storage rate alone. This lifecycle view belongs in the same cloud cost optimization analysis as egress itself.

08 Cost-control framework

Egress cannot be controlled until it is measured by path. Work through these four steps in order — attribution first, so engineering effort lands on the flows that matter rather than spreading thinly across the estate.

09 Our recommendation