Ingress vs egress: the GCP network bill that surprises everyone

Every time I review a GCP bill, the question is the same: "why did cloud get more expensive when we added no servers?" The answer is almost always traffic, not compute.

The rules worth memorising

• Ingress (data in) is generally free — with exceptions such as cross-region load balancing.
• Egress (data out) is billed based on destination.
• Traffic between VMs in the same zone is mostly free; crossing zones or regions is not.

Path	Billed?
Internet → VM	no
VM → VM, same zone, internal IP	no
VM → VM, cross-zone	yes
VM → Internet	yes, per GB
VM → Cloud Storage, same region	no, with private Google access

Real case: images pulled across an ocean

A client ran compute in asia-southeast1 and kept the asset bucket in us-central1. Every page load pulled images across the Pacific — 1.4 TB a month, thousands of baht invisible in the compute dashboard.

Moving the bucket into the same region and putting CDN in front cut spending by 62% the following month.

Five moves that actually reduce the bill

1. Colocate anything that talks frequently in one region.
2. Put Cloud CDN in front of every static asset.
3. Use private service access instead of exiting to the internet and back.
4. Set budget alerts at 50/80/100% wired into Slack.
5. Enable VPC flow logs for a week to see who talks to whom before optimising.

Reading the invoice fast

In the Billing Report, group by service and look at Networking first. Then filter SKUs containing Egress to see whether it is internet, inter-region or inter-network.

Short version: egress is rent for the road, not the house. Design so data travels the shortest distance and the bill falls without a single negotiation.