Cloud Cost Optimization Framework

Network costs are often the most overlooked—and most optimizable—component of cloud bills. This framework provides a systematic approach to understanding, measuring, and reducing your cloud networking expenses.

Understanding Cloud Network Costs

Cloud networking costs are fundamentally different from on-premise. In your data center, you buy switches and pay for circuits—costs are relatively fixed. In the cloud, you pay per byte transferred, per hour of load balancer runtime, and per VPN connection. Understanding these cost drivers is the first step to optimization.

The Big Three Cost Categories

1. Data Transfer (Egress): Typically 60-80% of networking costs. You pay to send data out of the cloud.
2. Load Balancers: Hourly charges plus per-GB processing fees.
3. NAT Gateways / VPN: Hourly charges plus data processing fees.

Data Transfer Pricing Landscape

Data transfer pricing is complex and varies by source, destination, and volume:

Prices as of 2024; always verify current pricing.

1. Measure Before Optimizing

You can't optimize what you don't measure. Before making changes, establish baselines:

Enable Cost Allocation Tags

• Tag all networking resources (load balancers, NAT gateways, VPN connections)
• Use consistent tag schemas (environment, team, application)
• Enable tags in Cost Explorer/billing reports

Analyze Flow Logs

• AWS VPC Flow Logs: Parse with Athena to identify top data transfer endpoints
• Azure NSG Flow Logs: Analyze with Traffic Analytics
• GCP VPC Flow Logs: Query with BigQuery

-- AWS Athena query: Top 10 destinations by bytes transferred
SELECT destinationaddress, SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE action = 'ACCEPT' AND destinationaddress NOT LIKE '10.%'
GROUP BY destinationaddress
ORDER BY total_bytes DESC
LIMIT 10;

Create a Cost Dashboard

• Track daily/weekly trends in data transfer
• Alert on anomalies (unexpected spikes)
• Compare costs across environments and regions

2. Reduce Egress to Internet

Internet egress is the largest cost driver. Every GB you avoid sending to the internet saves $0.05-0.12.

CDN for Static Content

• Move static assets to CDN: Images, CSS, JS, videos should be served from CloudFront, Cloud CDN, or Azure CDN
• Cost comparison: CDN egress is typically $0.02-0.04/GB vs. $0.09+ from origin
• Cache everything possible: Higher cache hit ratio = lower origin egress
• Consider CDN for API responses: Even short TTLs can dramatically reduce origin traffic

Compression

• Enable gzip/brotli: Reduce response sizes by 70-90% for text content
• Application-level compression: Compress before encryption for even better ratios
• Image optimization: WebP, AVIF formats; lazy loading

VPC Endpoints for AWS Services

Traffic to S3, DynamoDB, and other AWS services can bypass the internet gateway:

• Gateway endpoints (S3, DynamoDB): Free to use
• Interface endpoints (other services): $0.01/hour + data processing, but can reduce NAT gateway costs

3. Optimize Cross-Region Traffic

Cross-region data transfer costs $0.01-0.02/GB. At scale, this adds up quickly.

Data Locality

• Colocate compute with data: Don't run analytics in us-east when your data is in eu-west
• Replicate read-heavy data: Local read replicas can be cheaper than constant cross-region queries
• Regional processing: Process data in the region where it's generated

Efficient Replication

• Incremental replication: Only transfer changed data (AWS S3 Replication, GCP Transfer Appliance)
• Compression for replication: Compress data before cross-region transfer
• Off-peak transfers: Some providers offer lower rates for flexible timing

4. NAT Gateway Optimization

NAT Gateways charge both hourly ($0.045/hour) and per-GB processed ($0.045/GB in AWS). A busy NAT Gateway can cost $500+/month.

Strategies to Reduce NAT Costs

• VPC Gateway Endpoints: S3 and DynamoDB traffic doesn't need NAT when using gateway endpoints
• Interface Endpoints for API calls: AWS API calls (EC2, STS, etc.) can use interface endpoints
• Self-managed NAT instances: For dev/test, a t3.micro NAT instance is much cheaper (but less reliable)
• Single NAT Gateway per AZ: Don't over-provision; one per AZ is sufficient for most workloads

NAT Gateway Instance Sizing

NAT Gateway scales automatically to 45 Gbps. If you're hitting bandwidth limits, you have multiple options:

• Multiple NAT Gateways with route table distribution
• Split workloads across subnets with different NAT Gateways

5. Load Balancer Optimization

Load balancers charge hourly plus LCU (Load Balancer Capacity Units) for processing. Optimization opportunities:

Consolidation

• Use path-based routing: One ALB can serve multiple applications via path rules (/api/*, /web/*)
• Host-based routing: Single ALB for multiple domains (api.example.com, www.example.com)
• Avoid unnecessary load balancers: Internal services can sometimes communicate directly

Right-Size Health Checks

• Don't check too frequently (every 30s is often sufficient)
• Use simple health check endpoints (avoid heavy database queries)

Consider Network Load Balancer

NLB is often cheaper than ALB for non-HTTP workloads:

• No processing charge, only hourly
• Better performance for TCP/UDP

6. Reserved Capacity and Commitments

For predictable workloads, committed use discounts can significantly reduce costs:

Direct Connect / Interconnect

• Dedicated connections: Cost-effective for >10TB/month of egress
• Egress pricing: $0.02/GB via Direct Connect vs. $0.09/GB via internet
• Break-even analysis: Typically 5-10TB/month justifies dedicated connectivity

Committed Use Discounts

• GCP: Committed use discounts for networking resources
• AWS: Private pricing agreements for large volumes
• Azure: Enterprise agreements with custom pricing

7. Architecture Patterns for Cost Efficiency

Multi-AZ vs. Single-AZ

• Production: Always multi-AZ for availability
• Development/Test: Single-AZ can reduce cross-AZ transfer costs by 90%
• AWS-specific: Cross-AZ data transfer costs $0.01/GB each way ($0.02/GB round-trip)

Service Mesh Considerations

Service meshes (Istio, Linkerd) add sidecar proxies that can increase east-west traffic:

• Measure the overhead before and after implementation
• Consider mTLS termination at load balancer level

Caching Layers

• Add ElastiCache/Memorystore: Reduce database round-trips and associated network traffic
• Application-level caching: Reduce external API calls
• GraphQL/BFF patterns: Reduce over-fetching from APIs

8. Monitoring and Governance

Automated Alerts

• Alert when daily egress exceeds baseline by >20%
• Alert on new NAT Gateway or load balancer creation
• Weekly cost reports by team/application

Governance Policies

• Require justification: New public IPs, NAT Gateways, cross-region replication
• Cost limits: Set budgets per project with alerts at 80%, 100%
• Quarterly review: Analyze top cost drivers and optimization opportunities

Quick Wins Checklist

Key Takeaways

• Egress costs dominate—optimize with CDN, compression, and caching
• Measure first using flow logs and cost allocation tags
• VPC endpoints eliminate unnecessary NAT Gateway traffic
• Consolidate load balancers using path-based and host-based routing
• Consider Direct Connect when egress exceeds 10TB/month
• Implement governance to prevent cost creep