Data transfer: the cloud line item nobody owns
Egress and inter-zone traffic quietly become a top-five cost line for scaleups. Here is how to make it visible, attribute it, and design it down.
Why egress is different
Compute and storage have owners. Somebody provisioned that instance; somebody created that bucket. Data transfer has no owner — it is the byproduct of an architecture decision made months earlier by someone who never saw the bill.
By the time a scaleup passes roughly €50k/month in cloud spend, data transfer is very often in the top five line items and almost always the least understood one.
The four costs hiding under "networking"
1. **Internet egress.** Data leaving the cloud to end users. Usually the largest and the hardest to reduce without touching the product.
2. **Cross-region transfer.** Replication, backups and multi-region services chatting with each other.
3. **Cross-availability-zone transfer.** The quiet one. Charged in both directions on some providers, and generated by every chatty microservice that ignores zone topology.
4. **NAT gateway processing.** Per-gigabyte charges on top of transfer, for traffic that often did not need to leave the VPC at all.
Making it visible
You cannot attribute what you cannot see. Three steps, in order:
- **Enable flow logs** on your main VPCs, sampled if volume is a concern.
- **Join flow logs to workload tags** so traffic maps to a service, not an IP range.
- **Report transfer cost per service, monthly.** Not per account — per service. Account-level reporting is where egress goes to hide.
Design changes that actually move the number
- **Zone-aware routing.** Keep service-to-service calls within an availability zone by default and fail over across zones only when needed. On a chatty mesh this alone can cut cross-AZ charges substantially.
- **VPC endpoints for provider services.** Traffic to object storage or managed databases through a NAT gateway is paying twice for something a private endpoint handles cheaply.
- **CDN in front of anything user-facing.** Cached delivery is usually materially cheaper per gigabyte than raw origin egress, and it improves latency at the same time.
- **Compression and payload discipline.** Verbose JSON between internal services is a direct cost. Compression on internal APIs is a one-line change with a measurable bill impact.
- **Backups to the same region.** Cross-region backup is a real requirement for some workloads and a copy-paste default for many others. Confirm which one you have.
Give it an owner
The durable fix is organisational. Add data transfer cost to the same dashboard where teams already see compute cost, attributed by service, reviewed in the same monthly cadence. Once an engineering team can see that their service generates €4k/month of cross-AZ traffic, the architecture conversation happens without anyone from finance having to start it.
Realistic expectations
Egress reduction is slower than right-sizing — it involves architecture, not configuration. Expect the visibility work to take two to three weeks and the design changes to land over a quarter. The payoff is that, unlike a one-off cleanup, it does not regress.