Egress

Egress refers to data leaving a defined boundary, such as a network, a security zone, or a cloud provider. In cloud computing, egress usually means data transfer out: traffic that flows from the provider's network to the public internet, to another region, or sometimes between availability zones. Its counterpart, ingress, is data flowing in, which providers typically do not charge for.

How It Works

Providers meter egress by gigabyte, with rates that vary by destination. Data leaving to the internet is usually the most expensive; cross-region transfer costs less; transfer within the same region or zone is cheaper or free, though cross-zone traffic can still incur charges. Egress also has a security dimension: egress filtering controls which outbound destinations workloads may reach, limiting data exfiltration and command-and-control traffic. Architects reduce egress cost by caching with a content delivery network, compressing data, keeping chatty services in the same zone, and choosing region placement carefully.

Why It Matters

Egress is one of the most underestimated cloud costs. Bandwidth-heavy applications, data replication, backups to other regions, and multi-cloud architectures can run up large bills that are invisible until they appear on the invoice. Egress fees also create a form of lock-in, since moving large datasets out of a provider is costly. From a security view, controlling egress is a key defense against data theft. Understanding and modeling egress is therefore both a FinOps and a security concern.

Related Terms

Egress relates to virtual private cloud networking, is mitigated by content delivery networks, and is a significant FinOps and region-placement factor.