Reducing Cloud Egress Costs in Observability

Telemetry volume grew 93% year over year on average, and one in five organizations saw growth above 150%, according to a Coleman Parkes survey of 450 enterprise leaders commissioned by Dynatrace. Every gigabyte of that data that leaves your VPC for a SaaS backend pays a toll, and usually more than one. The cloud egress costs observability pipelines generate stack across separate meters: internet egress, cross-AZ transfer, NAT gateway processing, and flow-log delivery, often on the same bytes. For a platform engineer the fix is architectural: process telemetry on the node that produces it, and pay transfer fees only on bytes that earn their trip.

What are cloud egress costs

Egress is data leaving a cloud provider's network or crossing a billable boundary inside it; ingress is data coming in. All three major providers make the trade asymmetric: inbound transfer is free, and providers meter outbound transfer per gigabyte. On AWS, internet egress starts at $0.09/GB for the first 10 TB per month, so a pipeline shipping 10 TB of telemetry monthly to an external endpoint pays roughly $900 before any other charge applies.

Why providers charge for outbound but not inbound data

The asymmetry is an economic design, and Dave McCrory named the underlying force in 2010: data gravity. Data accumulates mass, applications and services move toward it, and, in McCrory's words, "data if large enough can be virtually impossible to move." Free ingress builds that mass; egress fees raise the escape velocity. The UK Competition and Markets Authority investigates egress fees as switching barriers that distort competition, and IDC's egress fee analysis states plainly that "data egress fees are difficult for organizations to forecast."

How egress pricing works across AWS, Azure, and GCP

Platform teams choose different architectures because each traffic path carries a different rate. The table below shows first-tier rates for North American traffic as of July 2026, from the official AWS, Azure, and GCP pricing pages:

Three details matter in practice. AWS aggregates the internet tiers across EC2, S3, RDS, CloudWatch Logs, and other services, so volume discounts kick in on your total footprint. Azure eliminated its cross-AZ fee on May 21, 2024, which means multi-AZ collector topologies on Azure avoid an intra-region tax that identical AWS and GCP deployments still pay. And GCP prices in GiB (1 GiB = 1.0737 GB), which shifts break-even math at scale.

The hidden drivers in cloud-native architectures

Teams usually find the surprise when several meters apply to the same bytes. These paths generate egress charges that most teams discover only on the invoice:

• NAT gateways: AWS charges $0.045/GB of data processed, additive on top of all underlying transfer charges. Telemetry leaving a private subnet for the internet pays $0.045 processing plus $0.09 egress, $0.135/GB combined. Route through a NAT gateway in a different AZ and the total climbs to $0.155/GB.
• Cross-AZ API traffic: default kube-proxy routing distributes traffic across all pods regardless of AZ placement, silently generating $0.02/GB round-trip charges. When traffic crosses AZ boundaries twice through a Network Load Balancer, the cost doubles to $0.04/GB.
• Data replication: RDS cross-region read replicas bill replication traffic at $0.02/GB out of the source region; Aurora Global Database charges the same under Aurora pricing on top of replicated write I/O and storage in both regions.
• CDN origin pulls: AWS waives transfers from AWS origins to CloudFront under CloudFront pricing, but a third-party CDN pulling from S3 pays internet egress, and misconfigured cache policies can add $800–$1,200/month in origin fetch charges per distribution.
• Managed database exports: RDS snapshot exports to S3 cost $0.013/GB for PostgreSQL and MySQL, and each export re-sends the full snapshot rather than a delta. BigQuery exports across locations bill at GCP cross-region transfer rates.

How observability telemetry amplifies your egress bill

SaaS observability generates egress by design: the model requires raw telemetry to leave your infrastructure and transit to vendor-managed cloud. Datadog operates isolated sites (US1, US3, US5, EU1) that cannot share data, and its own documentation notes that cloud providers charge egress fees when agents ship over public IPs. The recommended fix, private networking, is site-specific: AWS PrivateLink covers US1 plus AP1/AP2 but not US3, US5, EU1, or Gov sites. New Relic explicitly charges nothing for egress on its side, but the customer pays inter-region transfer costs when using VPC peering or cross-region PrivateLink to reach it.

Per-GB math gets painful at telemetry scale. If your nodes sit in private subnets, every byte of that traffic also transits a NAT gateway at the combined rate above. Filtering before transmission works: Halodoc cut ingestion from 2 TB/day to roughly 550 GB/day by dropping HTTP request logs in FluentBit before they left the EKS cluster.

Key strategies to reduce egress costs

The list orders the levers below roughly by effort-to-impact for a Kubernetes environment, and every figure comes from a published benchmark or case study:

• Compression: zstd achieves a 44.23× ratio on large trace payloads versus gzip's 34.07× in OTel Collector benchmarks. Grafana Mimir measured zstd cutting remote-write traffic 54% versus Snappy while dropping 99p write latency from 90ms to 50ms. OTel-Arrow's production trial showed 30–70% network bandwidth reduction over OTLP/gRPC, with the trade-off of roughly 43% more CPU for about 25% egress reduction.
• Tail sampling: VictoriaMetrics demonstrated a 70% cut in compressed trace traffic at 15,000–30,000 spans/s with retroactive sampling. Pismo cut trace data costs almost 80% with OTel Collector tail sampling.
• In-cluster aggregation and filtering: a documented two-layer agent/gateway pipeline dropped spans leaving the cluster from 12,400/s to 2,100/s; health-check spans alone were 40% of volume before filtering. Kaltura's Fluent Bit DaemonSet plus OTel Collector architecture across 8 TB/day of logs and traces produced a 60% cut in observability operational costs.
• Field-level trimming and deduplication: Adevinta removed redundant timestamps, whitespace, and hostname fields with Vector and cut costs 35%, roughly €30,000 per year. One redundant timestamp alone was worth over 40 GB/day.
• Caching and CDN offload: keep origins behind CloudFront where AWS-origin fetches are free, and use Origin Shield, which typically reduces origin fetches 40–60%.
• Data locality: same-AZ traffic over private IPs is free. Kubernetes 1.35's trafficDistribution: PreferSameZone achieved 100% same-zone traffic in a 5,000-request test. For S3-bound traffic, gateway VPC endpoints carry no data processing or hourly charges, bypassing the NAT gateway entirely.
• Private interconnects: at sustained volume, dedicated links beat internet rates by $0.06–$0.07/GB. Dedicated links become cheaper only after sustained monthly transfer crosses a fixed-volume threshold.

Monitoring egress without making it worse

The obvious instrument, VPC flow logs, is itself expensive:

• AWS: AWS bills flow logs as vended logs at $0.50/GB for the first 10 TB into CloudWatch Logs ($0.25/GB to S3 or Firehose), which means flow logs can cost more than the infrastructure they watch.
• Azure: Azure charges $0.50/GB collected after 5 GB free, plus $2.30–$3.50/GB for Traffic Analytics processing.
• GCP: GCP's Cloud Logging waiver removes the generation charge when flow logs stay in Cloud Logging but bills it if you exclude them.
• Operational control: AWS's own guidance tells teams to scope flow logs to specific ENIs or subnets and disable them when not troubleshooting.

Flow logs also stop at IP pairs. As a 2025 KubeCon talk put it, "cloud vendor reports lack the granularity of information to tell which pods or workloads are responsible for the elevated cross-zone traffic." eBPF closes that gap from inside the cluster. Polar Signals built Polar Signals Kubezonnet specifically because Cilium could not provide per-pod cross-zone reporting; it exposes a pod_cross_zone_network_traffic_bytes_total metric. Grafana Beyla exports an experimental beyla.network.inter.zone.bytes metric with src.zone and dst.zone attributes. Cilium/Hubble, despite 20% production adoption, has cross-AZ attribution only as an open feature request.

The same in-cluster principle applies to the full telemetry pipeline. groundcover's Flora sensor deploys as a DaemonSet, captures every network call at the Linux kernel level, and runs stream processing at the node before anything is stored. Storage lands in ClickHouse and VictoriaMetrics inside your own VPC, so the observability data itself crosses no billable boundary.

Attributing egress to services and teams

Attribution is where cloud-native billing falls down: providers offer only IP-to-IP breakdowns for data transfer costs, and pod IPs are ephemeral. Two tools have documented per-workload cost attribution. Coroot v1.4+ calculates egress costs per application on the three major providers and on-prem. Datadog Cloud Network Monitoring exposes source and destination AZ and region tags with kube_service aggregation.

The payoff from attribution is concrete. Datadog's own engineering team used its network monitoring to discover that roughly two-thirds of all data its applications fetched lived in a different availability zone; configuring rack-awareness saved an estimated $630,000 annually in cross-AZ transfer. For chargeback, join per-pod byte counts from an eBPF exporter with your provider's transfer rates and namespace-to-team ownership labels; the result is a per-microservice egress line item that flow logs alone cannot produce.

When private interconnects beat public internet

Dedicated links trade a fixed monthly port fee for a discounted per-GB rate, so the decision is a volume threshold. The table computes break-even points from official pricing against first-tier internet egress:

Port fees are not the whole cost. AWS port prices exclude cross-connect, colocation, and local loop fees; a third-party analysis puts an all-in 1 Gbps non-redundant setup near $1,500/month, moving break-even to roughly 21 TB/month. Azure requires a Virtual Network Gateway for private peering at $0.19–$1.87/hr on top of the circuit, and GCP redundancy doubles connection costs. Below a few TB per month of steady transfer, stay on the public internet and spend the effort on volume reduction instead.

How egress costs fit the multi-cloud and vendor lock-in picture

Egress fees function as a portability tax, and the CMA's analysis draws the distinction that matters for observability: switching-cost distinction covers one-off switches that incur egress costs once and integrated multi-cloud architectures that incur recurring fees. A telemetry pipeline that spans providers pays internet rates on every crossing, every month, and single-cloud cost tooling that reads only one provider's billing data never sees the other side of the flow. The 2024 exit-fee waiver programs do not help here: Azure's waiverexplicitly excludes multi-cloud and hybrid customers who keep any Azure footprint, and AWS and Google both require moving all data off the platform. The EU Data Act mandates zero switching charges from January 12, 2027, but that covers exit events, not ongoing operational egress.

BYOC removes the observability portion of this exposure structurally. A common misconception: teams assume BYOC means self-hosting the entire product. It does not, unless you choose the fully on-premises or air-gapped modes.

In groundcover's Bring Your Own Cloud architecture:

• The data plane runs inside your VPC. ClickHouse stores telemetry events, including logs and traces; VictoriaMetrics stores metrics.
• groundcover manages the control plane and UI.
• Telemetry never transits to a vendor's cloud, so there is no per-byte egress meter running on it.
• Pricing is flat per node (around $35/node/month) rather than per GB, so cost is decoupled from volume in both directions: no cloud egress on the data and no ingestion penalty for keeping all of it.

To measure that architecture on your own cluster, the Free tier deploys through the groundcover Console in 20–30 minutes with no credit card.

What's next for egress cost management

Several mechanisms are moving from niche to standard practice, and each attacks a different meter:

• CDC delta replication: snapshot replication re-sends the entire dataset each cycle, while change data capture reads transaction log changes and ships only deltas. BigQuery cross-region replication explicitly meters Network egress bytes, so the byte savings show up directly on the bill. One documented migration replaced a ~$60K/month batch pipeline with CDC that added only about $1K of infrastructure at 20B+ messages per month.
• Data repatriation economics: all three providers launched exit-fee waivers between January 11 and March 13, 2024, matching the EU Data Act timing. AWS removed its prior 100 GB minimum threshold in September 2025, lowering the bar for full moves off-platform.
• Regional pricing and waivers: GCP's Standard Tier has included 200 GB of free monthly internet transfer per region since October 2023, and Google's Data Transfer Essentials offers no-cost multicloud transfer for EU/UK customers. The UK CMA process produced a 180-day Azure switching window that counts individual service exits, not only full platform exits.
• Smart routing: Azure's Routing Preference (Transit ISP) drops NA/EU first-tier egress from $0.087 to $0.08/GB, and GCP's Standard Tier undercuts Premium at $0.085/GiB versus $0.12/GiB for traffic that tolerates public-internet routing.
• Cold storage tiering: Datadog Flex storage prices logs at $0.05/million events stored versus $1.06–$2.50/million indexed; Azure Auxiliary Logs ingest at $0.10/GB versus $2.30/GB for Analytics Logs. Tiering decides which telemetry is worth the expensive path before it moves at all.

‍