The "Free" Ingress Trap
Think of a cloud provider like a storage unit facility. Moving your belongings into the unit is free — they want your business. But every time you take something out, you pay a fee. The more you take out, the more you pay. Cloud providers operate on exactly this model, and many engineering teams only discover it when they receive their first large bill.
Cloud providers (AWS, Azure, Google Cloud) charge for network traffic in a deliberately asymmetric way:
- Ingress (Data coming IN): Almost always free. They want you to bring your data to them.
- Egress (Data going OUT): Expensive. Taking data out of the cloud — or even moving it around within the cloud — costs real money.
Many engineering teams optimize their compute (using Spot instances) or storage (using cold tiers) but completely ignore data transfer costs. This leads to "bill shock," where network transfer fees exceed the cost of the servers themselves. A team running a modest analytics pipeline might spend $200/month on EC2 instances and $800/month on data transfer — and never notice until someone audits the bill line by line.
Egress Cost Engineering is the discipline of designing network architectures specifically to minimize these transfer fees without sacrificing reliability, security, or performance. It is not about being cheap — it is about understanding that every architectural decision has a network cost, and making those decisions deliberately.
Interviewers at cloud-native companies frequently ask: "Walk me through how you'd reduce an unexpectedly high AWS bill." A strong answer always includes data transfer costs as a first-class concern alongside compute and storage. Candidates who only mention Reserved Instances or Savings Plans reveal a blind spot. Mention the NAT Gateway trap, cross-AZ replication costs, and VPC endpoints as concrete levers.