Cloud egress optimization explains why your network bill grows faster than product usage and how small architectural choices create recurring, avoidable spend. Most engineering teams treat bandwidth as a line item, not a system to be engineered; that is expensive and reversible.
The stakes are easy to calculate. AWS charges $0.09/GB for the first 10 TB a month of data sent from EC2 to the internet, after the first 100 GB free (AWS EC2 pricing); Amazon S3 data transfer out is priced the same way (Amazon S3 pricing). So serving 50 TB a month straight from AWS to the internet costs roughly $4,400 in transfer alone (the first 10 TB at $0.09/GB, the next 40 TB at $0.085/GB), before backups, analytics exports or third-party ingestion are added.
Direct answer: Three changes remove most avoidable egress on AWS: serve static and downloadable content through CloudFront, because transfer from S3 to CloudFront is not charged (Amazon S3 pricing); route private-subnet traffic to S3 through a gateway VPC endpoint, which has no hourly or data processing charge, instead of a NAT Gateway at $0.045/GB processed (AWS VPC pricing); and run heavy processing in the same region as the data, because inter-region transfer costs $0.02/GB (AWS EC2 pricing). How much you save depends on your traffic mix, so measure per-flow volumes before and after each change.
Cloud egress optimization patterns
Three buckets explain most of the bill: transfer to the internet, transfer between regions or availability zones, and transfer to third-party clouds and vendors. AWS charges $0.09/GB for the first 10 TB to the internet, $0.02/GB between most regions and $0.01/GB in each direction between availability zones in the same region (AWS EC2 pricing). Sending data to another cloud or a SaaS vendor is billed as internet egress on your side.
CDNs change the arithmetic. AWS does not charge for data transferred from S3 to CloudFront (Amazon S3 pricing), so cached content stops paying origin egress and you pay CloudFront's delivery price instead, which depends on region, volume and plan (CloudFront pricing). The saving is largest for assets requested many times, such as images, video segments and software downloads.
Another common surprise is the NAT Gateway. AWS bills $0.045 per gateway-hour plus $0.045 per GB processed in its published example (AWS VPC pricing). If large S3 downloads from private subnets go through NAT, you pay that processing charge on every gigabyte. Gateway VPC endpoints for S3 and DynamoDB have no hourly or data processing charge, and AWS notes that routing S3 traffic through one avoids the NAT processing fee (AWS VPC pricing).
Latency and cost usually move together. Serving content from an edge location close to users shortens the round trip to your origin, and fewer timeouts mean fewer retries, which are a hidden source of duplicate transfer. Measure p95 latency and retry rates before and after a CDN change, so you can report the speed gain alongside the saving.
Egress is not an accounting footnote. It is an architecture decision, and most of the avoidable spend sits in a few flows you can reroute.
Measure before you optimize. Tag every egress-producing flow (source service, destination, reason) and break the bill down per flow using AWS Cost and Usage Reports or VPC Flow Logs. In most inventories a small number of flows, such as an analytics export or a nightly snapshot copy, account for most of the volume. Fix those first.
Cache and compress aggressively. Serve static assets through CloudFront or Cloudflare, enable Gzip or Brotli compression and set long cache lifetimes for versioned files. Every request answered from the edge cache is one your origin does not send, so track the cache hit ratio and origin bytes as your success metrics.
Architect for locality. Run ETL and feature extraction in the same region as your object store or database, because inter-region transfer costs $0.02/GB on most AWS routes (AWS EC2 pricing). Traffic between availability zones costs $0.01/GB in each direction, so keep chatty services and their databases in the same zone where your availability design allows it.
Use cloud primitives to avoid needless hops. Replace NAT-proxied object downloads with S3 Gateway Endpoints or signed CloudFront URLs. Replace cross-account HTTP uploads with S3 multipart direct-to-origin when clients can authenticate directly; that moves compute out of your VPC and avoids NAT/EC2 egress. When budget permits, negotiate egress discounts with CloudFront or buy an enterprise Cloudflare plan to get reduced per-GB rates.
Beware cross-cloud data gravity. Data leaving AWS for BigQuery, Snowflake in another cloud or an analytics vendor is billed as data transfer out on your AWS account. Batch and compress heavy exports on a schedule instead of streaming every event, and check whether the vendor can run in the same cloud region as your data.
What this means for a CTO or technical founder
Treat this as a short, staffed project rather than a side task. A small team can usually complete the inventory and the first fixes (CDN, gateway endpoints, compression) within a few weeks. Because AWS bills monthly, you will see the effect in the next bill, which makes the return easy to prove.
Prioritize work by ROI, not comfort. Start with measurement and tagging, then pick the highest-dollar, lowest-risk changes: CDN configuration, S3/CloudFront origin switching, VPC endpoint adoption, and compression. Save architecture-level refactors (region consolidation, re-platforming to managed analytics) for the second wave once you’ve harvested the easy wins.
Treat egress as a first-class non-functional requirement. Include estimated egress delta in PRs for features that transfer files or large datasets. Add unit tests or smoke checks that model transfer volumes for nightly jobs so developers are aware of long-term costs at commit time rather than when the AWS bill arrives.
3-step checklist to reduce egress (actionable)
1) Inventory and tag all egress flows for 30 days and break the bill down by flow. 2) Apply caching and direct paths (CloudFront, signed URLs, gateway endpoints) to the two largest flows, then measure origin bytes and latency. 3) Move the remaining heavy flows in-region or compress and batch them, then use your real volumes to negotiate CDN or committed-use pricing.
Key takeaways:
1. On AWS, internet egress is $0.09/GB for the first 10 TB, inter-region $0.02/GB and cross-AZ $0.01/GB each way, so a few high-volume flows usually drive the bill. 2. S3 to CloudFront transfer and gateway VPC endpoints carry no transfer or processing charge, which makes them the cheapest first fixes. 3. Measure per-flow volumes before and after each change so the saving is proven, not assumed.
Egress is an engineering problem with a commercial fingerprint. If your roadmap includes more video, large exports or multi-tenant analytics, make egress part of the cost model for those features. If you want a second pair of eyes on your bill, Eltherion projects start as low as $1,000; tell us what you are running.
