Cloud cost is set by the commitment structure and the data transfer line, not by the published rate card. This benchmark separates list from realized across the three hyperscalers and isolates the egress line that drives the budget overrun.
Cloud cost is set by the commitment structure and the data transfer line, not by the published rate card. This benchmark separates list rates from realized cost across AWS, Azure, and Google Cloud, and isolates the egress line that quietly carries the budget overrun.
About this benchmark
The Redress Compliance Cloud Commit and Egress Benchmark is a directional read, not a price list. It draws on three inputs.
We report bands and directions, not precise discounts. Individual outcomes vary widely with estate size, workload mix, and commit timing. Where a single number appears, treat it as the middle of a range rather than a guarantee.
The published rates are not the bill. Once committed spend discounts and unmetered lines like data transfer are folded in, the realized rate lands in a band. That band runs roughly 8 to 14 percent below blended list on a well sized three year commit.
The headline matters less than the spread beneath it. Two estates of the same total spend can land 12 points apart on realized rate depending on how the commit was sized and how much of the bill is data transfer rather than compute.
List rates are the sticker. Realized cost is the signature. The gap between on demand and a three year commit can exceed 50 percent on compute. Few estates capture that maximum. Unutilized commit, egress, and non discounted services drag the blended figure back toward a 10 percent realized rate.
That gap is the entire game. The buyer who pays attention to it builds the negotiation around realized cost. The buyer who chases the headline tier pays the headline price on the unutilized portion.
AWS, Azure, and Google Cloud price differently on commit but converge on the same realized band once usage is normalized. AWS prices commit through Savings Plans and the EDP discount layer. Azure prices through reservations and the MACC commitment. Google Cloud prices through CUDs and committed use contracts. The mechanics differ. The outcome converges.
The point is not that one vendor is cheaper than another at list. It is that the realized cost is a function of how the buyer structures the deal, not which logo is on it. A poorly structured Azure commit will out cost a well structured AWS commit on identical workloads.
A small number of unit costs sit outside the commit. On demand instances above the commit ceiling, certain managed service surcharges, and data transfer to the public internet are billed at list rates and rarely discounted at typical enterprise volumes.
That part of the bill is not negotiable in the usual sense. It is controllable through architecture and traffic shaping, but it will sit at list. Underestimating that uncontrolled share is the single most common budgeting error.
Each hyperscaler dresses the same idea in different clothes. The buyer commits a minimum spend or a minimum capacity over a term. The vendor offers a discount that scales with depth and length. The mechanics differ, the leverage points differ, and the trap is the same.
AWS offers two layers. Savings Plans commit to an hourly compute spend for one or three years and discount the instances that fall under the commitment. The Enterprise Discount Program commits to an annual total spend and adds a discount on top across most services. The two layers can stack.
The EDP discount tier scales with depth. A modest annual commit lands in single digit territory. The deeper tiers, which require very large annual commits and often a five year term, can reach the high twenties or more on list. The deeper the tier, the larger the unutilized risk if usage shifts.
Azure prices through reservations and through the Microsoft Azure Consumption Commitment, the MACC. Reservations buy specific capacity, similar to the older AWS reserved instances. The MACC commits a total Azure spend over a term, often three years, and unlocks a discount band against an enterprise agreement.
Azure's commit mechanic interacts with the broader Azure pricing and licensing posture, including any Microsoft Azure Hybrid Benefit the buyer carries. That hybrid benefit can swing the effective rate on Windows and SQL Server workloads more than the commit discount itself.
Google Cloud commits run as CUDs, spend based commitments, or committed use contracts at the enterprise level. The Google Cloud pricing documentation publishes the headline percentages for one and three year commitments on most compute and database services.
The Google mechanic is the most transparent of the three on paper. The actual realized rate still depends on the same variables, how well the commit is sized and how much usage sits outside it, so the headline discount tells only part of the story.
Egress is the cost of moving data out of the cloud. To the public internet, to another region, and in some cases across zones inside the same region. It is metered at list and almost never discounted at the volumes a typical enterprise generates.
Egress is the line buyers forget. It does not appear on the commit page, it is not negotiated at signing, and it is invisible until the bill arrives. By then the architecture has already locked the cost in.
Public internet egress, indicative list rates
| Vendor | First TB | Up to 10 TB | Up to 50 TB | Above 50 TB |
|---|---|---|---|---|
| AWS, US east | $0.09 / GB | $0.085 | $0.07 | $0.05 |
| Azure, North America | $0.087 / GB | $0.083 | $0.07 | $0.05 |
| Google Cloud, North America | $0.12 / GB | $0.11 | $0.08 | $0.08 |
| Inter region, same provider | $0.02 to $0.05 | tier scales | tier scales | tier scales |
| Cross zone, same region | $0.01 to $0.02 | tier scales | tier scales | tier scales |
Moving data from the cloud to the public internet sits at the top of the price ladder. AWS EC2 and data transfer pricing places the first tier near nine cents per gigabyte before volume tiers drop the rate. Azure and Google Cloud sit in the same band on their North America rates.
For a data heavy workload, a single TB transferred to the internet daily is roughly twenty five to thirty thousand dollars a year at list. Multiply by ten and the line item rivals a meaningful share of the compute spend, with no commit discount available to offset it.
Cross region replication is a routine modern design. It is also a sustained, metered cost that does not appear on the original architecture diagram. A multi region active passive design moves the cost from a one time replication to a permanent stream that lives on the bill forever.
The trap is that inter region transfer is sold as a feature. It is also a line item, often two to five cents per gigabyte across regions, that compounds with traffic volume and rarely sees a discount.
Inside a single region, traffic across availability zones can carry a small per gigabyte cost. Individually negligible, in aggregate across a microservice estate it is one of the larger surprises on the bill, especially where the design assumed everything in the region was free.
This is the line that catches teams that move from a single zone deployment to a multi zone resilient design. The resilience is real. So is the new egress line that arrived with it.
By starting from the bill you already have, not from the forecast the business wants. Trailing twelve month consumption is the anchor. Forward growth is a defensible band on top of it. The depth of the commit follows from both, not from the discount tier the vendor wants you to reach.
The trailing twelve month spend on the services you intend to commit is the only number that has actually been billed. It already absorbs the seasonality, the rollouts, and the abandoned projects. Anchoring the commit there avoids paying for activity that already turned out not to happen.
Buyers who anchor on a strategic forecast routinely over commit by twenty percent or more. Buyers who anchor on the trailing twelve months hit the commit and earn a smaller, real discount on the spend the business actually generates.
A growth band of eight to fourteen percent on the trailing draw is a defensible add. It accounts for organic growth in existing workloads, not for a hoped for new project that has not yet been funded. New projects belong in a separate consumption envelope outside the commit.
The optimistic case is the vendor's friend, not the buyer's. Every percent of growth committed but not used becomes spend on services the business did not need at the rate it could not negotiate down.
A portion of the bill always sits outside the commit and at list. That headroom is by design. It absorbs the surprise workloads, the AI services that ramp faster than expected, and the projects that need flexibility on rate rather than volume.
Buyers who commit one hundred percent of expected spend leave themselves no room. The first unexpected workload tips them into the on demand premium for the rest of the term.
The standard advice is to maximize the committed spend tier to earn the deepest cloud discount. We disagree. In the cloud estates we benchmark, over committing to a multi year tier locks in spend the business cannot fill, so the effective rate ends higher than a smaller, well sized commitment. The buyer side move is to size the commitment to defensible baseline usage, keep headroom out of the commit, and treat egress as a first class budget line rather than a surprise. A smaller, accurate commit beats a bigger, optimistic one in every renewal we have modeled.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
The discount sits on the spend you commit. The bill sits on the spend you make. The two only meet when the commit is sized to reality.
On the headline page, AWS, Azure, and Google Cloud look different. On the realized rate, they converge. Each will reach a band of roughly eight to fourteen percent off list for a well sized three year commit on a mature enterprise workload mix.
Three hyperscalers, three commit mechanics, one realized band
| Vendor | Primary commit | Secondary lever | Egress posture | Realized band |
|---|---|---|---|---|
| AWS | EDP annual spend | Savings Plans | List, tier discount above 10 TB | 8 to 14% |
| Azure | MACC three year | Reservations + Hybrid Benefit | List, tier discount above 10 TB | 8 to 13% |
| Google Cloud | Spend based CUD | Resource CUDs | List, narrower tier breaks | 9 to 14% |
AWS reaches the band most often through a three year EDP at a modest tier plus a layer of Savings Plans tuned to steady compute. The five year deep tier is rarely a better deal once unused commit is counted, even when the headline discount looks larger.
The realized advantage on AWS is in the breadth of services covered by the commit, not the headline percentage. EDP discount applies broadly. Savings Plans focus on compute. The combination is the lever.
Azure reaches the band through MACC commitment plus reservations on the durable VM and database footprint. Hybrid Benefit is the silent extra lever for buyers carrying existing Windows Server or SQL Server entitlements. Many estates leave that lever unused.
The Azure trap is treating the MACC alone as the optimization. Without reservations and Hybrid Benefit layered in, the same commit lands well above the realized band that good estates achieve.
Google Cloud's realized rate comes from spend based CUDs on the broad estate, combined with resource CUDs on the steady compute and database fleet. The mechanic is cleanly published, which makes Google the easiest of the three to model in advance.
That clarity is a double edged advantage. It removes excuses for over commit, because the model is plain. It also gives the buyer fewer rough edges to push back on at the table.
The realized band hides large differences between workload types. A steady compute fleet behaves nothing like a data heavy pipeline, and neither behaves like an AI consumption envelope. The commit and egress story changes shape for each.
Long running compute with predictable consumption is the easiest workload to commit. Reservations and CUDs tuned to the steady baseline capture the deepest realized discount with the lowest unused risk.
Mistakes here are rare and small. The realized rate for steady compute often sits at the top of the band, twelve to fourteen percent off list, with limited egress exposure if the data layer is local to the compute.
Pipelines that move large data volumes look cheap on compute and expensive on transfer. Inter region replication, outbound API delivery, and analytics queries crossing zones drive the bill more than the underlying compute. The egress line dominates.
For these workloads the realized rate sits at the bottom of the band or below, because the egress component is at list. Commit shopping does little. Architecture shopping does a lot.
AI consumption is the fastest moving line on most modern bills. Model usage, vector storage, and inference traffic combine into a workload that the buyer routinely under forecasts. AI services rarely benefit fully from the commit layer in their first year.
The buyer side move is to budget AI separately, treat the early bill as the forecast, and revisit the commit at twelve months once a real consumption baseline exists. Committing AI capacity in year one is almost always premature.
Cloud marketplaces let a buyer route third party SaaS spend through the hyperscaler bill, applying a portion of that spend to the commit. Used well, this is a significant lever. Used badly, it turns SaaS optimization into a hidden cloud over commit.
The discipline is to route only SaaS the business already buys, never SaaS purchased to reach the next commit tier. The first is leverage. The second is the costliest version of commit chasing.
Three anonymized patterns from the engagement file show how the same commit math plays out differently with preparation. The figures are bands, not exact outcomes. Details are generalized to protect confidentiality.
A growing SaaS buyer signed a five year EDP at the strategic forecast to reach the deepest discount tier. By year two, actual draw was twenty eight percent below the commit floor. The headline discount was real. The unused commit was a permanent line on the bill.
Restructuring at renewal was difficult because the five year term still had years to run. The realized rate, once the unutilized share was counted, sat well above what a smaller three year commit would have produced. The deeper tier looked like savings at signing and behaved like waste through the term.
A large financial buyer ran a multi region active active architecture for resilience. Inter region replication and cross zone traffic compounded into a transfer line that finance had not modeled. The bill grew faster than the compute base for two consecutive years.
A clean baseline of where data actually moved, built before the next renewal, narrowed the scope. Selective replication and a small architecture change cut the inter region line by roughly a third without touching the resilience target. The capability survived. The line item shrank.
A manufacturer rolled out an internal AI assistant on a hyperscaler model service. Inference consumption ramped four times faster than the original forecast inside six months. The team treated it as a feature toggle, not a contract, so no envelope had been agreed.
A staged contract restructure carved AI consumption out of the base commit, added a separate envelope with a quarterly review, and capped the burn rate for the following twelve months. The capability stayed. The exposure narrowed. The renewal that followed was bounded rather than open.
Some commit cycles open quietly and some do not. The difference is usually visible months ahead. A handful of signals reliably flag a renewal that will land above the band.
The clearest signal is a recent change in workload mix. A move toward AI, a new analytics platform, or a multi region rollout shifts the commit math even when headline spend looks similar. The next renewal carries the shift, with or without the buyer's attention.
Watch any change that moves data more, runs inference at scale, or extends across regions. Each is a quiet driver of the egress and on demand lines that sit outside the commit.
A decision to add a region, replicate a database, or move a queue across zones rarely lands in the finance model the same week it ships. The bill arrives later, and by the time it is read, the design is in production.
The reliable defense is a checkpoint between architecture and finance on any change that adds a new transfer path. The conversation costs nothing. The line item it prevents can cost a great deal.
A cloud forecast that was right last year is not a forecast that will be right next year. The point of trailing twelve month data is that it has already happened. The point of a growth band is to absorb uncertainty without committing the optimistic case as if it were the base case.
The realized rate is decided by the contract more than by the conversation at the table. A commit with the right clauses bounds the next year's exposure before it is proposed. A commit without them leaves the buyer exposed every cycle.
The single most valuable clause is the right to carry forward unused commit, or to true down within a band, if the business misses the target. A commit without flexibility is a take or pay agreement with no exit from a forecast that turned out wrong.
Buyers who negotiate explicit carry forward and a defined true down window pay for what they use. Buyers who do not pay for what they signed. The clause is rarely refused if it is asked for early.
Public internet egress is hard to negotiate down on price, but the rate can be held for the term and the volume tier breaks can be locked. An envelope on inter region transfer, sized to the architecture, prevents the surprise multi region bill that compounds silently.
The strongest version of this clause sets a unit rate, a tier schedule, and a price hold that covers the full term. The realized egress line is then a question of architecture rather than a question of the vendor's next list move.
The newest essential clause treats the AI consumption envelope as its own agreement, with its own term, cap, and exit. Folding AI into the base commit hides the fastest growing line and removes the ability to right size it at the next cycle.
For most enterprises in 2026, this is the single highest leverage move at the next renewal. The AI line is the one buyers cannot forecast accurately, so the clause has to absorb that uncertainty.
Marketplace routing lets a buyer apply third party SaaS spend to the cloud commit. The clause to negotiate is which categories of SaaS qualify and at what rate. Without it, routing can drift toward SaaS bought to fill the commit rather than SaaS the business actually needs.
Commit control fails most often as an ownership problem, not a negotiation problem. When no one owns the commit calendar, the next renewal arrives as a surprise and is handled in a hurry. That is exactly when buyers over commit.
The renewal needs one accountable owner, usually in FinOps or procurement, measured on realized rate against benchmark rather than on closing the deal quickly. An owner rewarded for speed signs early and high. An owner rewarded for realized cost starts early and pushes.
That measure matters more than any tactic at the table. Buyers who hold the realized band widest are simply the buyers who started first and were measured on the right outcome.
Finance sets the budget band and the contingency. Engineering confirms the architecture and the realistic growth path. Both need to be in the conversation six to nine months before signing, not consulted at signature.
The common failure is a renewal that reaches finance and engineering only when the vendor needs the deal closed. By then the timeline itself has become the vendor's strongest lever.
An independent advisor adds the benchmark and the market view that no internal team sees across enough deals to hold. The highest return point to engage is before the first vendor proposal, when the position is still open and structure is still negotiable.
Up again, but with a different mix. We expect another high single digit blended increase, with the AI consumption line and inter region traffic as the dominant drivers rather than base compute rate moves.
The buyers most exposed are those who signed AI envelopes in early promotional windows in 2024 and 2025. As introductory pricing expires, the renewal of the AI layer becomes its own repricing event, on top of the base commit. Treat every AI envelope as a contract with its own term, cap, and exit.
A buyer who folds AI consumption into the base commit cannot see the line and cannot right size it. A buyer who carved it out can read the actual ramp and bring it to the next renewal with data, not surprise.
The migration to multi region designs accelerated through 2025 and continues through 2026. The egress line that follows compounds for years after the design ships. Expect the 2027 bill to carry the cost of every 2024 and 2025 architecture decision finance was not in the room for.
The defensive move is to read the 2027 bill backward into the 2026 architecture. Every new region added in the last twelve months is a 2027 line item the budget should already know.
Vendors that have already reset their commit models will lean on AI consumption and inter region rates rather than headline list moves. The list cards may look calm while the realized bill keeps climbing through consumption meters. That makes 2027 harder to read from public price pages alone.
The discipline lives in process more than in any single negotiation. A handful of recurring activities, run on a calendar, do more for realized cost than any tactic at the table. The point is to make the next cycle a planned event rather than a reaction.
Start with a clean trailing twelve month bill, segmented by service, region, and commit eligibility. Refresh it every quarter. The buyer who has that artifact at hand can answer any commit question with data. The buyer without it answers with the vendor's spreadsheet.
The baseline is also the FinOps tool. It surfaces drift, idle capacity, and the slow movement of spend across services that often gets noticed too late to correct.
Egress instrumentation is the cheapest piece of FinOps work and one of the most leveraged. Tag traffic by source and destination, by region, and by zone. The picture that emerges usually shows a small number of paths drive the line and a small number of architecture changes can shrink it.
Most surprises on the egress line are not new traffic. They are traffic the architecture already moves that nobody has counted.
Every cloud contract belongs on a single shared calendar, with the next decision point flagged twelve months ahead. Built once and maintained, the calendar converts every renewal from a surprise into a planned event with time to prepare.
This single discipline does more for realized cost than any negotiation move. The buyers who hold the realized rate lowest are simply the buyers who never let a renewal arrive unprepared.
A benchmark is only useful if its limits are stated. This benchmark is a directional read on the realized cost of cloud committed spend and egress. Several things sit outside it on purpose.
The benchmark tracks the cloud bill itself, not the cost of professional services, partner managed offerings, or the internal headcount needed to run the platform. Those are real and often material, but they are project costs that move on their own cycle rather than the price of the cloud capacity.
We exclude them so the benchmark stays comparable year to year. Mixing project spikes into a price signal would make the trend impossible to read.
The benchmark reflects the path a buyer takes with the hyperscaler directly. It does not assume a buyer adopts a third party FinOps tool, a multi cloud broker, or a co location alternative for steady workloads. Each of those choices can change the picture materially.
Those options are exactly what a credible alternative looks like. The benchmark measures the default path so the value of stepping off it is visible by comparison.
Pricing varies by region and currency, and a global estate will see effects the benchmark does not localize. Read it as a direction and then localize to your own currency, region, and service mix.
This is why we publish bands rather than precise figures. A single decimal would imply a precision that a cross vendor, cross region read cannot honestly claim.
On a well sized three year commit the realized rate lands eight to fourteen percent below blended list. Egress pulls the effective figure back up by two to four points. The realized cloud cost index reached 146 in 2026 on a 2021 base of 100. AI services and commit underutilization drove most of that rise.
Each hyperscaler offers a discount that scales with length and depth of a commitment. AWS prices through Savings Plans and the EDP layer. Azure prices through reservations and the MACC. Google Cloud prices through CUDs. A bigger commit unlocks a deeper headline discount and a larger unused risk.
Egress is the cost of moving data out of the cloud. It is billed at list and rarely discounted. Public internet egress sits near nine cents per gigabyte on the first tier across AWS, Azure, and Google Cloud. Tier breaks bring it down but the line stays large.
Anchor on trailing twelve month draw on the services you intend to commit, add a defensible growth band of eight to fourteen percent, and keep ten to twenty percent of expected spend outside the commit as headroom. The optimistic forecast is the vendor's friend. The trailing bill is the only number that has actually happened.
Not as a default. In most estates we benchmark, the deeper tier locks in spend the business cannot fill. The realized rate ends higher than a smaller well sized commit. Deeper tiers make sense only when usage is unusually visible. A smaller, accurate commit beats a bigger, optimistic one.
At list they look different. At realized rate they converge into a narrow eight to fourteen percent band. AWS leans on EDP plus Savings Plans. Azure leans on MACC, reservations, and Hybrid Benefit. Google leans on spend based CUDs. The deciding variable is structure, not logo.
The egress trap is the gap between what architecture designs and what finance budgets. Multi region replication, outbound delivery, and cross zone traffic are routine design choices. They are also permanent metered lines that sit at list. Buyers who treat egress as a small percentage often see it land near twenty percent.
Budget egress as a first class line, not as a small percentage of compute. Forecast it from the architecture, not from history alone, because a new multi region design or a new outbound feature can change the line overnight. Treat internet egress, inter region transfer, and cross zone traffic as three separate sub lines with their own review cycle.
Partly. AI services can apply capacity to the commit. The consumption profile usually grows three to five times faster than the buyer forecast in the first year. Committing AI capacity in year one is almost always premature. Budget AI separately, watch the ramp, and revisit the commit at twelve months.
The commit sizing model by workload profile, the egress lines vendor by vendor, the realized rate bands, and the renewal clause checklist that holds the gap widest between vendor proposal and realized cost.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement, finance, and FinOps leaders running the next commit cycle.
The vendor sells the discount. The architecture writes the bill. The buyer who sees both pays the floor.
