Network egress is the surprise charge that catches every GCP team at least once. You build a perfectly optimized architecture, right-size your VMs, tune your BigQuery queries — and then discover you're paying hundreds or thousands per month for data moving between regions, to the internet, or even between services in the same project.

The asymmetry is what makes it frustrating: ingress (data coming in) is free, but egress (data going out) is not. And "out" doesn't just mean the internet — it means any data leaving a zone, a region, or a VPC. This pricing model creates hidden costs in architectures that look perfectly reasonable until the bill arrives.

This guide breaks down where network costs come from, which ones you can control, and the architectural decisions that prevent surprises.

How GCP Network Pricing Works

GCP network pricing follows a tiered model based on where data travels. The farther it goes, the more it costs:

Premium vs Standard network tier

GCP offers two network tiers:

The ingress/egress asymmetry

This pricing model has a deliberate consequence: it's cheap to get data into GCP but expensive to get it out. This affects decisions about:

• Multi-cloud architectures: Moving data between GCP and AWS/Azure incurs egress
• Hybrid setups: On-prem to GCP communication costs add up
• API-heavy applications: Every API response is egress

The Biggest Egress Cost Drivers

Not all egress is equal. Some patterns generate surprisingly large bills.

1. Cross-region replication

If your architecture spans multiple regions (for high availability or compliance), every replicated byte is billed:

2. API responses to end users

Every HTTP response from Cloud Run, GKE, or App Engine is internet egress. For API-heavy applications:

3. BigQuery cross-region queries

If your BigQuery dataset is in us-central1 but your application reads results from europe-west1, you pay egress on the query results. This also applies to cross-region joins — BigQuery moves data to execute the query and bills egress for it.

Fix: Keep your BigQuery datasets in the same region as the services that query them.

4. Cloud Storage downloads

Every time a user or service downloads from GCS, it's egress. For public-facing storage (images, documents, media), this can be the largest single line item:

5. VPN and Interconnect data transfer

Data flowing through Cloud VPN or Dedicated Interconnect is also billed for egress. Interconnect offers discounted egress rates ($0.02/GB vs $0.085/GB for internet), which is why high-volume hybrid architectures favor Interconnect over VPN — the data transfer savings alone can justify the circuit cost.

Cloud NAT — The Silent Cost Multiplier

Cloud NAT is one of the most misunderstood cost items on GCP. It lets private VMs and containers access the internet without public IPs. Sounds simple, but the pricing catches people off guard.

What Cloud NAT charges

Cloud NAT has two cost components:

• $0.045 (NAT processing) + $0.085 (internet egress) = $0.13/GB total

Why costs explode with containers

GKE and Cloud Run workloads using private networking route all internet-bound traffic through Cloud NAT. In container environments, this includes:

• Pulling container images from public registries
• Calling external APIs (payment processors, SaaS tools, etc.)
• Downloading dependencies during builds
• Health checks to external services

Private Google Access — the free alternative

For traffic to GCP APIs (BigQuery, Cloud Storage, Pub/Sub, etc.), use Private Google Access instead of Cloud NAT:

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-private-ip-google-access

This routes GCP API traffic through Google's internal network at no charge, bypassing Cloud NAT entirely. For many workloads, 50-80% of NAT traffic is actually going to GCP APIs.

CDN and Load Balancer Costs

Cloud CDN pricing

Cloud CDN charges for two things: cache fill (pulling content from your origin) and cache egress (serving content from cache to users).

• Low cache hit ratio (unique content per user, dynamic responses)
• Low traffic volume (CDN fixed costs outweigh savings)
• Content changes frequently (constant cache invalidation)

Load balancer costs

GCP load balancers charge for data processing, and the charges vary by type:

Choose the right LB for your traffic:

• Use Network LB (passthrough) for internal TCP/UDP traffic (no data processing charge)
• Use Regional External Application LB instead of Global when you only serve one region
• Consider direct Cloud Run URLs for internal service-to-service calls that don't need load balancing

GCS Lifecycle and Operation Costs

Cloud Storage pricing has two components that trip people up: storage class and operations.

Storage class pricing

The lifecycle rule trap

Lifecycle rules automatically move objects to cheaper storage classes as they age. This saves on storage costs but increases retrieval costs. The trap: if you access "cold" data regularly, the retrieval fees can exceed the storage savings.

Example: Moving 1 TB from Standard to Coldline saves $16/month in storage. But if you access 10% of that data monthly, retrievals cost $2/month — acceptable. If you access 50%, retrievals cost $10/month — most of the savings disappear.

Rules of thumb:

• Nearline: Data accessed less than once per month
• Coldline: Data accessed less than once per quarter
• Archive: Data accessed less than once per year (backups, compliance)

Class A vs Class B operations

GCS also charges per-operation, and the prices differ dramatically between operation types:

• ETL pipelines that write millions of small files
• Listing operations on buckets with millions of objects (each LIST call is Class A)
• Overwriting objects frequently (each write is Class A)

Multi-region vs single-region buckets

Reducing Network Costs

1. Keep traffic in the same region

The single most impactful decision for network costs is co-locating services and data. If your app, database, and storage are all in us-central1, most internal traffic is free.

Common mistakes:

• App in us-central1, BigQuery dataset in us (multi-region) — cross-region query results
• Cloud SQL in us-central1, read replica in europe-west1 — continuous cross-region replication
• Cloud Run in us-east1, GCS bucket in us-west1 — every object fetch is cross-region egress

2. Use Private Google Access instead of NAT

Enable it on every subnet. For most workloads, this eliminates 50-80% of Cloud NAT traffic at zero cost.

3. Compress API responses

Enable gzip/brotli compression on Cloud Run, GKE services, and App Engine. A typical JSON API response compresses 70-80%, directly reducing egress costs.

Cloud Run service - most frameworks handle this automatically
For Express.js:
app.use(compression())
For Python/FastAPI with uvicorn:
Use --proxy-headers and let the load balancer handle compression
Or use GzipMiddleware

4. Cache at every layer

5. Choose single-region when multi-region isn't needed

Multi-region is a compliance or HA requirement, not a default. Unless you have users or regulatory requirements in multiple regions, single-region deployments eliminate cross-region data transfer entirely.

6. Monitor with billing export

SELECT
  service.description AS service,
  sku.description AS sku,
  ROUND(SUM(cost), 2) AS total_cost,
  ROUND(SUM(usage.amount), 2) AS total_gb
FROM project.dataset.gcp_billing_export_v1_XXXXXX
WHERE invoice.month = '202603'
  AND (
    sku.description LIKE '%Egress%'
    OR sku.description LIKE '%Network%'
    OR sku.description LIKE '%NAT%'
    OR sku.description LIKE '%Data Processing%'
    OR sku.description LIKE '%Download%'
  )
GROUP BY service, sku
ORDER BY total_cost DESC;

This query shows all network-related charges across all services. Run it monthly to catch new egress patterns before they become expensive.

Putting It All Together

This week (30 minutes)

• [ ] Run the billing export query to identify all network/egress charges
• [ ] Check if Private Google Access is enabled on all subnets
• [ ] List all Cloud NAT gateways and their monthly data processing volume
• [ ] Verify your services and data are in the same region

This month (2-3 hours)

• [ ] Enable Private Google Access on all subnets that lack it
• [ ] Add Cloud CDN to GCS buckets serving public content (if cache hit ratio > 80%)
• [ ] Enable response compression on all API services
• [ ] Review cross-region replications — are they all necessary?
• [ ] Check GCS lifecycle rules for retrieval cost impact

This quarter

• [ ] Evaluate Standard vs Premium network tier for non-user-facing workloads
• [ ] Audit load balancer types — switch to passthrough Network LB where applicable
• [ ] Consider Dedicated Interconnect if VPN egress exceeds $500/month
• [ ] Consolidate to single-region where multi-region isn't required
• [ ] Set up budget alerts filtered to network SKUs

Expected results

Surprised by network charges on your GCP bill? GCP FinOps helps growing companies identify and eliminate cloud waste without enterprise complexity.

Related Articles:

• GCP Cost Optimization Guide for Growing Companies
• GCP Billing Export to BigQuery: Complete Setup Guide
• Finding and Eliminating Idle GCP Resources
• BigQuery Cost Optimization: The Complete Guide