AWS egress, engineered pricing and not a law of physics
AWS bills egress per gigabyte leaving its network, steepest on traffic to the public internet, while inbound and in region transfer stay mostly free: the bill is shaped by internet and cross region patterns, and the common advice, that egress is an unavoidable utility cost, is exactly wrong. Egress is engineered pricing, and it negotiates like everything else engineered.
Prepared by Redress Compliance · August 7, 2026 · AWS advisory. Based on 30 to 40 AWS estates benchmarked 2024 to 2025.
Executive summary
Most estates paid list for volume they could have committed.
Egress was paid at public list in 60 to 70 percent of the estates that could have committed it into an Enterprise Discount Program.
And buyers who arrived with a measured egress profile consistently beat the public tiers: the EDP blended rate delivered typical reductions of 20 to 40 percent against the meter.
The prerequisite is the measurement, twelve months of egress split by internet, cross region, and exit traffic, because a commitment modeled on ignorance converts list waste into committed waste.
The blind spot precedes the bill. 25 to 45 percent of buyers had no clear view of their cross region and internet egress split before renewal, and the architecture leaked alongside: chatty cross region designs, billed both ways in many patterns.
Added 10 to 25 percent of egress that a routing change would have removed.
The architecture diagram is the egress invoice in advance, and the routing fix is free money the negotiation never has to ask for.
The paths reprice what the meter charges.
CloudFront moves internet facing traffic to a separate, cheaper, committable tier, with the origin shield cost priced in; PrivateLink keeps service to service traffic off the public internet path and its rate, removing internet egress a public design would incur.
And region consolidation cuts the cross region line at the source.
The path decisions are negotiation preparation, because the committed volume prices best when it is the volume that remains after the engineering.
The exit is free, on request, and narrower than it sounds.
Since March 2024, following European regulatory pressure on switching costs, AWS gives free data transfer out to the internet for customers fully leaving AWS, requested rather than automatic, and it applies to an exit, not to ongoing multi cloud traffic.
The distinction prices the lock in honestly: the exit egress is now free, and the every day inter cloud line is precisely the one that most needs a committed rate.
The egress levers, and the trap on each
| Lever | What it changes | Best for | The buyer trap |
|---|---|---|---|
| The EDP commitment | A blended egress rate replacing list tiers | Large, stable, measured volume | Overcommitting volume you never consume |
| CloudFront routing | A separate, cheaper, committable tier | Internet facing traffic | Ignoring the origin shield cost |
| The architecture fix | Removes cross region waste at the source | Chatty multi region designs | Treating cross region as free |
| The exit credit | Zero internet egress on departure | A full AWS exit | Assuming it covers ongoing multi cloud traffic |
Egress accrues in three places, and the map precedes the negotiation.
Internet facing application traffic at the steepest rate and usually the largest line, cross region replication charged both ways in many designs, and data leaving for another cloud or on premises, the line that makes lock in expensive.
Mapping twelve months of volume to each source is the prerequisite for committing any of it, because the EDP that bundles unconsumed egress is a cost wearing a discount.
The EDP commitment, modeled correctly
The sequence holds the model honest: instrument twelve months of real egress by source first; cost the routing fixes second, because the 10 to 25 percent the architecture wastes should never be committed.
Route internet facing traffic through CloudFront at committed pricing third, moving the largest line to the cheaper tier; and only then decide which volume commits into the EDP at the blended rate and which stays on demand.
The commitment discipline mirrors the compute side, worked in the Savings Plans guide: commit the measured floor, never the forecast, because the blended rate on consumed volume is the 20 to 40 percent and the same rate on phantom volume is a donation.
The AWS data transfer negotiation playbook
The egress profile built by source, the CloudFront and PrivateLink repricing, the EDP blended rate mechanics, and the exit credit in writing.
Get the white paper →The path engineering, before the rate negotiation
- CloudFront for the internet line: public traffic moved to a separate egress tier, usually cheaper at volume and committable, with origin shield costs priced into the comparison.
- PrivateLink for the private integrations: high volume service to service traffic kept off the internet path entirely, removing charges a public design incurs by default.
- Region consolidation for the chatty designs: replication billed both ways means consolidating services cuts the line at the source, the 10 to 25 percent no negotiation was needed for.
- The exit credit in writing: where a cloud exit is in scope, the free egress requested formally, because it is granted on request and covers the departure, not the daily multi cloud traffic.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across AWS estates, 2024 to 2025
Across roughly 30 to 40 AWS estates Morten Andersen benchmarked between 2024 and 2025, egress was almost always underestimated in the original commitment model:
Buyers with no clear view of their cross region and internet split before the renewal.
Estates paying public tiers for volume an EDP commitment would have blended down.
The framing that organizes the whole file: egress is the price of leaving, and the vendors that price it highest are the ones you most need a committed rate from.
The measured profile converts the meter into a negotiation, the routing engineering shrinks what needs negotiating, and the exit credit, real since March 2024.
Belongs in writing wherever an exit is even conceivable, because the free departure reprices the lock in argument every commitment conversation silently runs on.
Your first five moves
- Instrument twelve months of egress by source: internet, cross region, and exit traffic, because the profile is the negotiation.
- Cost the routing fixes for the chatty designs, the 10 to 25 percent that should be removed rather than committed.
- Model internet traffic through CloudFront at committed pricing, moving the largest line to the cheaper tier.
- Commit the measured floor into the EDP and leave the rest on demand, where the 20 to 40 percent blended saving lives.
- Request the exit egress credit in writing wherever an exit is in scope. The AWS negotiation practice runs the profile with you.
Frequently asked questions
How does AWS bill data transfer egress?
Per gigabyte on data leaving its network, in tiers with the steepest rate on traffic to the public internet, while inbound transfer and traffic within a region are mostly free.
The bill is therefore shaped by internet facing traffic, cross region replication, charged both ways in many designs, and data leaving for other clouds or on premises.
Can AWS egress pricing be negotiated?
Yes: committing measured volume into an Enterprise Discount Program at a blended rate beat the public tiers by 20 to 40 percent in our benchmarks, and 60 to 70 percent of estates that could have committed were paying list instead.
The prerequisite is twelve months of egress instrumented by source, because a commitment above real consumption converts list waste into committed waste.
Is AWS egress really free when leaving AWS?
Yes, since March 2024, following European regulatory pressure on switching costs: AWS provides free data transfer out to the internet for customers fully leaving, granted on request rather than automatically.
It applies to an exit, not ongoing multi cloud traffic, which is precisely the distinction that keeps the daily inter cloud line worth a committed rate.
How do CloudFront and PrivateLink reduce egress costs?
By changing where egress is billed and at what rate: CloudFront moves internet facing traffic to a separate, usually cheaper, committable tier, with origin shield costs priced in, and PrivateLink keeps service to service traffic off the public internet path, removing charges a public design incurs.
Both are negotiation preparation, shrinking and cheapening the volume that remains.
How much egress do architecture fixes recover?
10 to 25 percent of the volume in the estates we benchmarked, concentrated in chatty cross region designs where replication bills in both directions.
The architecture diagram is the egress invoice in advance, and the routing consolidation removes cost no negotiation had to win, which is why the fixes run before any commitment is sized.
What should an egress EDP commitment cover?
The measured floor only: twelve months of real volume by source, less the routing fixes, with the confident remainder committed at the blended rate and the volatile balance left on demand.
An EDP that bundles egress you never consume is a cost wearing a discount, the same commit to the floor rule that governs every AWS commitment.
