TL;DR
Multi-cloud was supposed to solve vendor lock-in. Instead, most enterprises have quietly built a second, invisible lock-in mechanism into their bandwidth architecture: every gigabyte that moves between clouds, across availability zones, or out to the internet carries a per-GB tax that never shows up as a single line item. Cloud egress rates run from roughly $0.087 to $0.12 per GB across the major hyperscalers, with NAT gateway processing and cross-AZ replication fees stacking on top — and multi-cloud environments carry a measurably higher waste rate than single-provider deployments as a direct result. The fix isn’t switching providers again. It’s architecting where data actually flows before the next renewal, not after finance flags the bill.
The Status Quo Trap: “We’re already multi-cloud, we’re covered on lock-in”
Ask most infrastructure leaders why they run workloads across two or three cloud providers, and the answer is usually some version of: “we don’t want to be locked into one vendor.” That’s the trap. Multi-cloud was adopted as a hedge against pricing power and outage risk — a legitimate goal — but almost nobody re-examined what it would cost to actually move data between those providers on an ongoing basis. The strategy solved for compute and storage lock-in while quietly recreating a worse version of it in the network layer.
The uncomfortable part: the industry knows this, and the marketing around it is designed to keep you from noticing. In 2024, under regulatory pressure tied to the EU Data Act, AWS, Azure and Google waived egress fees for full exits — but that concession is narrower than the headlines suggest. The same programs explicitly do not apply to ongoing multi-cloud use, and even the regulation driving the change is clear that regular operational egress — serving data to your users from the cloud — is not abolished; the Data Act addresses charges for switching providers, not day-to-day traffic costs. Full compliance across the EU doesn’t even land until 12 January 2027 — and it applies to EU-serving contracts, not the day-to-day multi-cloud replication traffic most U.S. enterprises are paying for right now. “Free egress” is an exit ramp, not a floor plan. It does nothing for the terabytes moving between your clouds every single day.
Teams still treating egress as an unavoidable cost of doing business — rather than a design choice made (or defaulted into) at the architecture layer — are the ones whose cloud bill keeps climbing even after a “cost optimization” pass on compute and storage.
The Tele Data Guru Framework: The Egress Exposure Matrix
Before signing off on another multi-cloud replication pattern, DR design, or CDN contract, score the data path against the four variables that actually determine whether bandwidth architecture is inflating the bill:
| Data Path Architecture | Egress cost impact | Latency / performance | Vendor lock-in risk |
|---|---|---|---|
| Direct Public Internet Egress (default) | High — every GB hits standard tiered rates with no discount unless volume is negotiated | Baseline, no optimization | Low lock-in, highest ongoing cost |
| NAT Gateway Routing (default AWS pattern) | Very high — adds a per-GB processing fee on top of standard egress, invisible on most dashboards | Minor added latency | Moderate — AWS-specific billing meter |
| Cross-AZ / Cross-Region Replication (multi-cloud DR) | High and compounding — per-direction charges multiply with every redundant copy | Improves resilience, not speed | Low lock-in, high recurring spend |
| CDN / Edge Caching | Low-moderate — discounted CDN tiers undercut raw egress for repeat content | Improves end-user latency | Moderate — CDN-specific configuration |
| Private Interconnect (dedicated circuit) | Low per-GB above breakeven volume — flat port fee replaces per-GB metering | Best latency and reliability | High — physical circuit tied to a provider pairing |
| Zero-Egress Object Storage Tier | Lowest — no per-GB egress charge in the pricing model | Comparable for most batch and backup workloads | Low lock-in, but limited compute-adjacent services |
Most enterprises default to whichever path the platform ships with — public internet egress plus NAT gateway routing — because it requires zero setup decisions. That default is also the most expensive combination on the matrix. Run this scoring exercise against your actual replication, backup, and cross-region traffic before the next network or cloud renewal, not after the bill arrives.
The Multi-Cloud Egress Tax Formula
Monthly Egress Tax = (Cross-Cloud Replication GB × Blended Egress Rate) + (NAT Gateway Processed GB × Processing Fee) + (Cross-AZ Redundancy GB × Per-Direction Rate)
Example: a workload replicating 50,000 GB/month between two clouds at a blended entry-tier rate — AWS charges roughly $0.09/GB, Azure $0.087/GB, and GCP $0.12/GB on its Premium Tier, while Cloudflare R2 charges $0.00 — comes out to roughly $4,250/month in raw egress alone. Route that same traffic through the default NAT gateway pattern and you add another layer: a data processing fee of $0.045 per GB for every byte that flows through, or roughly $2,250/month on that same volume. Add 15,000 GB of cross-AZ redundancy chatter — billed at approximately $0.01/GB per direction, even within the same region — and the total climbs past $6,800/month, or roughly $81,600/year, sitting inside a “data transfer” line item nobody reviews until finance asks why the networking category grew faster than compute. That math tracks with the broader pattern: data transfer frequently accounts for 10-20% of total AWS spend at mid-to-large scale once cross-AZ traffic, NAT gateway fees, and inter-region replication are added together. For workloads consistently above that volume, a dedicated interconnect changes the math — if a workload consistently moves more than 3-4 TB/month between a data center and AWS, Direct Connect typically pays for itself on egress savings alone, before latency and reliability improvements are even counted.
Commercial Realities & Vendor Pitfalls
- “Free egress” marketing only covers the exit, not the relationship. The 2024 waivers and the EU Data Act’s eventual switching-charge ban address leaving a provider — day-to-day operational egress is not abolished; the Data Act addresses charges for switching providers, not day-to-day traffic costs. Don’t mistake a divorce settlement for a discount on the marriage.
- NAT Gateway is the industry’s stealthiest default tax. It’s the path of least resistance to internet connectivity inside a VPC, and it silently adds a per-GB processing charge on top of every egress fee already being billed.
- “High availability” and “billing multiplier” are often the same architecture decision. Cross-AZ and cross-region replication built for resilience compounds per-direction transfer charges with every redundant copy — verify the resilience requirement actually demands the copy count before accepting the bill.
- Egress pricing is asymmetric by design, not by accident. Every major hyperscaler makes inbound data free and only meters the outbound side — a structure that makes moving data in cheap and moving it out (to another cloud, or away from the provider entirely) the expensive half of the transaction.
- Multi-cloud’s cost problem is structural, not incidental. Multi-cloud environments carry a 31% waste rate — 3 to 7 percentage points higher than any single-provider deployment, and bandwidth architecture between providers is a direct contributor to that gap.
- Overall cloud waste is trending the wrong direction. Cloud waste hit 29% of all global cloud spend in 2026, the highest rate in five years — data transfer sitting inside dozens of unreviewed line items is a large part of why it’s hard to see, let alone fix.
Implementation Checklist
- Map every cross-cloud, cross-region, and cross-AZ data flow currently running before renewing any circuit, CDN contract, or replication schedule.
- Tag replication, backup, and redundancy traffic separately from standard compute and storage spend so the true egress line item is visible on its own, not buried inside “networking.”
- Run the Egress Exposure Matrix against every workload still defaulting to Direct Public Internet Egress plus NAT Gateway routing.
- Calculate the private interconnect breakeven point against actual monthly replication volume — the math favors a dedicated circuit sooner than most teams assume.
- Move latency-tolerant, high-volume outbound traffic — backups, logs, cold archives — to a zero-egress or CDN-fronted storage tier.
- Replace NAT Gateway routing to cloud-native services with VPC or Gateway Endpoints wherever the provider supports the swap at no additional egress charge.
- Re-justify every cross-AZ and cross-region redundant copy against an actual resilience requirement, not a “more copies is safer” default.
- Build bandwidth architecture and projected egress cost into the RFP and vendor comparison at the next network or cloud renewal — before the contract is signed, not after the invoice lands.