Egress is data leaving a cloud boundary (often billed as data-transfer-out); ingress is data entering (often list-priced free for raw bytes, but load-balancer LCU/capacity, WAF, and NAT processing on replies can still bill). “Ingress free” is not “inbound architecture free.” Name direction and path class before any $/GB — knit the free-tier cliff for DT-out allotments and the NAT vs IGW spoke when private-subnet replies hairpin — Unknown until verified.
Updated
Egress leaving a cloud boundary and ingress entering are different meters — name direction before any $/GB arithmetic.
Path matrix: egress vs ingress cloud meters (educational)
Dated starting points only — Unknown until verified means no invented $/GB. PipeToll does not scrape private consoles or guarantee figures.
PipeToll titles lead with Cloud egress because American pipe-toll brands crowd SERPs — and because most surprise bills are egress, not inbound bytes. This spoke is the direction primer before object-store or CDN matrices.
Client → API → large response — request may be cheap ingress; response dominates egress.
Partner push into your bucket — their egress vs your ingress/ops; dual-cloud months need two ledgers.
Private subnet reply via NAT — inbound SYN is not the whole story; replies can hit NAT processing + Internet DT-out (triple-charge).
CDN miss fill — origin pull is egress from the origin’s point of view; see origin fill.
Common traps
Spreadsheets labeled “data transfer” with no direction column. Treating “ingress is free” as “inbound architecture is free” — LB processing, WAF, and NAT processing on replies still bill. Averaging quiet months that never leave the complimentary allotment (see free-tier cliff). Assuming VPC endpoints erase every meter. Blending partner push (their egress / your ingress) with client downloads on one line. No savings guarantee from flipping a public flag.
No direction column — “data transfer” without egress vs ingress vs internal hides which SKU moves. Label every major talker before $/GB arithmetic; start with glossary egress / ingress.
“Ingress free” = inbound path free — raw inbound bytes can be $0 list while ALB/NLB LCU, WAF, and NAT processing on replies still bill. Model replies as egress (+ NAT via NAT vs IGW / Mode B).
Quiet-month averages — months that never leave the complimentary DT-out allotment are not a permanent $0 rate. Split below-cliff vs above-cliff GB on the AWS free-tier cliff (multi-cloud: Azure & GCP cliffs).
Endpoints erase every meter — VPC endpoints / PrivateLink change path class for AWS-bound prefixes; they do not zero Internet SaaS, LB capacity, or InterZone chatter. Sibling: VPC endpoints vs NAT.
Partner push blended with client downloads — their egress / your ingress is a different ledger from your egress to clients. Dual-cloud months need two ledgers; do not subtract ingress from egress.
Incomplete → crown — Unknown cells stay Unknown. No savings guarantee from flipping a public flag. Stay FinOps-lite.
FinOps checklist
Label every major talker as egress, ingress, or internal (cross-AZ / endpoint).
Revisit after architecture changes — literacy is continuous.
See also the glossary terms for egress and ingress, and the FAQ for short answers.
FinOps-liteUnknown until verified
Worked example (educational): 50 GB in, 2,000 GB out
Measured shape: partners push 50 GB into object storage (ingress — often $0 list, still verify ops) while clients download 2,000 GB (egress).
Estimate egress with Mode A as GB × $/GB via ?path=egress-ingress&gb=2000; $/GB stays Unknown until a dated cite.
Do not subtract ingress from egress. Synthetic only — not a quote or savings guarantee.
Second educational stack (free-tier cliff knit): the same 2,000 GB client downloads sit above a complimentary Internet DT-out allotment. Split below-cliff vs above-cliff GB on the AWS free-tier cliff spoke before Mode A — quiet months that never leave the grant are not a permanent $0 rate.
Third educational stack (LB/NAT “ingress free but processing billed”): clients open TLS to an ALB (small request ingress) and private-subnet targets reply 1,200 GB via NAT → Internet. Raw inbound bytes may look free, but (1) LB LCU/capacity, (2) NAT hourly + processing × 1,200 GB, and (3) Internet DT-out on the replies still bill. Open Mode B (?mode=nat) for the NAT stack and Mode A for DT-out — never one blended “traffic” cell. See NAT vs IGW.
Hold the 50 GB in / 2,000 GB out shape and walk three direction runs. Every unit rate stays Unknown until dated provider cites — literacy arithmetic, not a quote.
Run A — egress-dominant leave: model 2,000 GB client downloads as Internet DT-out only (Mode A). Ingress 50 GB stays a separate (often $0 list) line — never subtract. Open Mode A (?path=egress-ingress&gb=2000).
Run B — free-tier cliff split: same 2,000 GB out, but split below-cliff vs above-cliff GB on the AWS free-tier cliff before Mode A. Quiet months that never leave the grant are not a permanent $0 rate.
Run C — ingress-looking path with billed replies: small request ingress to ALB + 1,200 GB private-subnet replies via NAT → Internet. Keep (1) LB LCU/capacity, (2) NAT hourly + processing × 1,200 GB, (3) Internet DT-out on replies as three visible meters — Mode B for the NAT stack, Mode A for DT-out. See NAT vs IGW.
Often list-priced at $0 for raw bytes into many clouds, but load-balancer capacity, WAF, and request processing can still bill. Verify the path — educational only.
Ingress free but LB/NAT processing still billed?
Yes — that is a common FinOps trap. Raw inbound bytes can be $0 list while ALB/NLB LCU capacity, WAF, and NAT processing on replies still appear on the invoice. Model replies as egress (+ NAT stack via NAT vs IGW / Mode B); do not treat “ingress free” as “inbound path free.”
Why separate egress from ingress on one worksheet?
Direction maps to different SKUs. Blending hides which architecture change could matter. PipeToll uses path templates first.
How do free-tier cliffs interact with ingress vs egress?
Complimentary allotments usually apply to egress / DT-out (or bandwidth leave), not to “ingress is free.” Model cliffs on the AWS free-tier cliff spoke; keep ingress processing lines separate.
Does this page quote $/GB?
No. Cells stay Unknown until verified against dated provider pages. See methodology.
Trademarks: Amazon Web Services, AWS, Microsoft Azure, Google Cloud Platform, GCP, and Cloudflare are trademarks of their respective owners. PipeToll (Ameti One LLC) is not affiliated with, endorsed by, or sponsored by those companies. Educational comparisons may be outdated — verify current rates with each provider.
