Cloud egress: Egress vs ingress path classes

Egress is data leaving a cloud boundary (often billed as data-transfer-out); ingress is data entering (often free, but load-balancer and processing SKUs can still apply). Name direction and path class before any $/GB — Unknown until verified.

Updated 2026-09-09

Egress leaving a cloud boundary and ingress entering are different meters — name direction before any $/GB arithmetic.

Path matrix: egress vs ingress cloud meters (educational)
Direction	Typical meter	FinOps trap	PipeToll next step
Egress / DT-out	Internet, inter-region, or cross-provider leave	Blending with ingress “because traffic is traffic”	AWS path checklist · Mode A
Ingress	Bytes into VPC/object store; often $0 list	Ignoring LB LCU, NAT processing on replies, or WAF	Separate inbound processing lines
Request/response pair	Small request in + large response out	Counting only request GB	Model response as egress
Private path	VPC endpoints / PrivateLink	Assuming “no Internet” means $0	VPC endpoints vs NAT
Free-tier window	Complimentary egress allotments	Averages that hide the cliff	Free-tier cliff

Path matrix: egress vs ingress cloud meters (educational)

Direction

Typical meter

FinOps trap

PipeToll next step

Egress / DT-out

Internet, inter-region, or cross-provider leave

Blending with ingress “because traffic is traffic”

AWS path checklist · Mode A

Ingress

Bytes into VPC/object store; often $0 list

Ignoring LB LCU, NAT processing on replies, or WAF

Separate inbound processing lines

Request/response pair

Small request in + large response out

Counting only request GB

Model response as egress

Private path

VPC endpoints / PrivateLink

Assuming “no Internet” means $0

VPC endpoints vs NAT

Free-tier window

Complimentary egress allotments

Averages that hide the cliff

Free-tier cliff

Provider source footnotes

AWS EC2 on-demand data transfer — as-of 2026-09-09 Unknown until verified

GCP network pricing — as-of 2026-09-09 Unknown until verified

Azure Bandwidth pricing — as-of 2026-09-09 Unknown until verified

Dated starting points only — Unknown until verified means no invented $/GB. PipeToll does not scrape private consoles or guarantee figures.

PipeToll titles lead with Cloud egress because American pipe-toll brands crowd SERPs — and because most surprise bills are egress, not inbound bytes. This spoke is the direction primer before object-store or CDN matrices.

Path templates to model

Client ← Internet ← compute/object — classic billed path template; watch free-tier cliffs.
Client → API → large response — request may be cheap ingress; response dominates egress.
Partner push into your bucket — their egress vs your ingress/ops; dual-cloud months need two ledgers.
Private subnet reply via NAT — inbound SYN is not the whole story; replies can hit NAT processing + Internet DT-out (triple-charge).
CDN miss fill — origin pull is egress from the origin’s point of view; see origin fill.

Common traps

Spreadsheets labeled “data transfer” with no direction column. Treating “ingress is free” as “inbound architecture is free.” Averaging quiet months that never leave the complimentary allotment. Assuming VPC endpoints erase every meter. No savings guarantee from flipping a public flag.

FinOps checklist

Label every major talker as egress, ingress, or internal (cross-AZ / endpoint).
Attach a spoke: checklist, NAT, or origin fill.
Deep-link Mode A for DT-out sensitivity; Mode B when NAT replies matter.
Keep cells Unknown until verified until dated cites exist per methodology.
Revisit after architecture changes — literacy is continuous.

See also the glossary terms for egress and ingress, and the FAQ for short answers.

FinOps-lite Unknown until verified

Worked example (educational): 50 GB in, 2,000 GB out

Measured shape: partners push 50 GB into object storage (ingress — often $0 list, still verify ops) while clients download 2,000 GB (egress). Estimate egress with Mode A as GB × $/GB where $/GB stays Unknown until a dated provider cite. Do not subtract ingress from egress. Synthetic only — not a quote or savings guarantee.

FAQ on this path

Is ingress always free?

Often list-priced at $0 for raw bytes into many clouds, but load-balancer capacity, WAF, and request processing can still bill. Verify the path — educational only.

Why separate egress from ingress on one worksheet?

Direction maps to different SKUs. Blending hides which architecture change could matter. PipeToll uses path templates first.

Does this page quote $/GB?

No. Cells stay Unknown until verified against dated provider pages. See methodology.