Kubernetes Internet Egress Cost: Prices, Sources and How to Reduce It

Internet egress is the charge for data leaving a cloud provider's network, and in October 2026 the first paid tier is $0.09 per GB on AWS, $0.12 per GiB on Google Cloud Premium Tier and $0.087 per GB on Azure. Inbound traffic is free on all three, so the bill is driven entirely by what your cluster sends out: responses to users, telemetry shipped to SaaS vendors, calls to external APIs and replication to other clouds.

Kubernetes does not meter any of this. The charge lands on the node, load balancer or NAT gateway that carried the bytes, which is why egress is one of the harder Kubernetes costs to attribute to a team.

How much does internet egress cost on AWS, GCP and Azure?

All three providers charge per gigabyte for data sent to the internet, with a small free allowance and lower rates at higher monthly volume. The table shows the first tiers for a US source region as of October 2026.

Sources: EC2 data transfer pricing and the AWSDataTransfer price list, Google Cloud network pricing, and Azure bandwidth pricing. AWS rate tiers aggregate data transfer out across EC2, S3, RDS, CloudWatch Logs and other services, so a busy S3 bucket can push your EC2 traffic into a cheaper tier.

Google Cloud prices Premium Tier by destination. Traffic from us-central1 to Australia, South America and several other destinations starts at $0.19 per GiB, and traffic to China starts at $0.23 per GiB. Standard Tier routes over the public internet and is cheaper. Google states that it gives "a lower quality of service."

What in a Kubernetes cluster sends traffic to the internet?

Anything that opens a connection to a public address and sends more than it receives. In most clusters, five sources account for nearly all of it.

• User-facing responses. API responses, file downloads, video and images served by pods behind a load balancer or ingress controller.
• Telemetry export. Logs, metrics and traces shipped to a SaaS observability or security vendor. Agents run on every node and send continuously, so volume scales with node count and log verbosity.
• External API calls. Payment, messaging, LLM and data APIs. Request bodies count as egress. Large uploads, such as documents sent to an AI API, add up quickly.
• CDN origin pulls. A CDN in front of your cluster fetches from your origin on every cache miss. With a CDN outside your cloud provider, each miss is billed as internet egress from your cluster.
• Replication and backups to another cloud or region. Database replicas, object storage sync and backup jobs that write off-site.

Container image pulls and package downloads are inbound, so they do not create internet egress charges. On AWS they still pass through a NAT gateway, which charges for processing in both directions. See EKS NAT gateway cost.

What does inter-region data transfer cost?

Inter-region transfer is billed separately from internet egress and is cheaper within a continent. Within the US it is $0.01 to $0.02 per GB on AWS, $0.02 per GiB on Google Cloud and $0.02 per GB on Azure.

In the AWS Cost and Usage Report these appear as usage types such as USE1-USW2-AWS-Out-Bytes, while internet egress appears as DataTransfer-Out-Bytes. Cross-zone traffic within one region is a third, separate charge. The cross-AZ data transfer guide covers it.

How much internet egress does a typical cluster pay for?

A single cluster serving user traffic and shipping telemetry from us-east-1 can easily pay more than $3,000 a month in transfer charges. The example below uses AWS prices from October 2026 and the price list's tier boundaries (10 TB = 10,240 GB).

Monthly traffic for an EKS cluster in us-east-1:

Two changes: serve downloads through Amazon CloudFront, and send telemetry to the vendor over AWS PrivateLink in the same region.

That is about $807 a month, or 25 percent, before compressing anything. CloudFront request charges are not included. Check the per-request price for your request volume. The replication line stays because it buys disaster recovery, and that is a business decision, not a cost leak.

How do I reduce Kubernetes internet egress?

Send fewer bytes, send them through cheaper paths, and stop sending what nobody reads. The list below is ordered roughly by how often each change pays off.

1. Put a CDN in front of cacheable responses. On AWS, CloudFront does not charge for origin fetches from EC2, S3 or Elastic Load Balancing, includes 1 TB a month free, and charges $0.085 per GB for the next 9 TB in the United States. Every cache hit is a byte your cluster no longer sends.
2. Compress responses and telemetry. Enable response compression, such as gzip, at the ingress controller or in the application for text responses, and turn on compression in log and metrics agents. Logs and metrics payloads are text, which compresses well.
3. Filter and sample telemetry before it leaves the cluster. Drop debug logs, health-check access logs and high-cardinality metrics at the collector. Keep full-fidelity data in a store in the same region and export only what the vendor needs.
4. Use private connectivity to SaaS vendors. Some vendors accept data over AWS PrivateLink. Datadog, for example, documents PrivateLink endpoints for its US1 site in us-east-1. An interface endpoint costs $0.01 per GB processed plus $0.01 per hour per zone, and in the same region there is no internet egress charge. Cross-region PrivateLink adds inter-region transfer.
5. Batch outbound calls. Fewer, larger requests cut per-request overhead such as headers and TLS handshakes, and give compression more data to work with.
6. Keep replicas and consumers in the region of their data. A consumer in another region or cloud turns every read into inter-region or internet egress.
7. On Google Cloud, consider Standard Tier for bulk, latency-tolerant traffic. It starts at $0.085 per GiB after 200 GiB free, against $0.12 per GiB on Premium Tier.

To know which of these matters for you, measure egress per workload and destination. A cloud bill shows DataTransfer-Out-Bytes per instance or load balancer, not per pod. The per-workload measurement guide explains how to get from node-level bytes to the deployment that sent them.

Free tiers are global

The AWS 100 GB and Google Cloud Standard Tier 200 GiB allowances apply once per account across all regions, not per cluster or per region. Do not count them more than once when you model several clusters.

<!-- callout:note -->

FAQ

Is inbound data transfer free in Kubernetes clusters?

Yes, on AWS, Google Cloud and Azure, data transfer in from the internet is free. Resources that process inbound traffic still charge: AWS NAT gateways bill $0.045 per GB in both directions, and Google Cloud lists load balancers and Cloud NAT as services that charge for processing inbound data.

Does traffic from pods to S3 or other AWS services count as internet egress?

No. Traffic to AWS services in the same region is not billed at internet egress rates. If it passes through a NAT gateway, you still pay $0.045 per GB for NAT processing, which a free S3 or DynamoDB gateway endpoint removes. The NAT gateway guide covers the endpoint setup.

Is the free egress allowance per cluster or per region?

Neither. AWS gives 100 GB a month aggregated across all services and regions, except China and GovCloud. Google Cloud Standard Tier gives 200 GiB a month per account across all regions. Azure gives the first 100 GB a month free.

Why can't I see egress cost per namespace in my cloud bill?

Cloud bills meter network interfaces, load balancers and gateways, not pods. A node runs pods from many namespaces, so its egress line has to be split by measured bytes per pod. That needs flow-level data from VPC Flow Logs, a service mesh or an eBPF agent.

Is cross-region replication billed as internet egress?

No. Traffic between regions of the same provider has its own, lower rates, for example $0.02 per GB from AWS us-east-1 to us-west-2. Replication to a different cloud provider leaves the network and is billed as internet egress.

How Kubeadapt measures this

Kubeadapt's Network Intelligence shows internet and cross-zone traffic cost per workload, measured by the optional eBPF agent kubeadapt-k8s-pulse. The agent runs as a privileged DaemonSet on Linux nodes with kernel 5.10 or later and is enabled with --set kubeadapt-k8s-pulse.enabled=true. It records connection byte counts, DNS query names and TLS server names, never request or response bodies, so you can see which deployment sends how much to which external hostname. Kubeadapt shows cost and recommendations and never changes your workloads. See Network Intelligence and the eBPF agent docs.

Related guides

• Kubernetes cross-AZ data transfer cost
• EKS NAT gateway cost
• Measure cross-AZ traffic per workload
• Cross-zone traffic from stateful workloads
• Glossary: egress