A 50 TB migration with a modest average rate of $0.09/GB can add about $4,500 to the bill. Costs rise when transfers cross regions, providers, or the public internet. Planning teams often miss routes like async replication, cross‑region backups, CI/CD artifact pulls, and multi‑AZ monitoring. These leaks move gigabytes and blow TCO assumptions.
Hidden bandwidth can add thousands to a cloud migration. This guide shows per‑GB charges across major providers and how to measure invisible transfers. It lists CDN, peering, bulk seeding, and rearchitecting tradeoffs. It also includes regional examples and a calculator to estimate true migration bills.
Expect a full procedure: packet sampling, flow logs, app tracing, and before/after case studies. The guide also lists runnable IaC, CDN, and peering snippets teams can test.
Costs and measurement of hidden egress bandwidth during migration
Hidden egress happens when data leaves a region, zone, or provider and the cloud bills outbound bytes. Map each transfer route and estimate GB by route instead of using a single average. The result is a predictable line item that stays small or becomes a major budget item.
Why route mapping matters
Each transfer path carries a different price tag. Treat internet egress, inter‑region, inter‑AZ, and private peering as separate cost centers. A single misclassified flow can add thousands of dollars to a migration.
Run real traffic captures before you push live migration.
Quick citable rule
Model egress in three buckets: one‑time bulk seed, repeated delta syncs, and ongoing outbound traffic. Separating one‑off costs from recurring charges clarifies choices between appliance, interconnect, or network transfer.
How to measure hidden egress before migrating
Measurement uses provider flow logs, sampled packet captures, and app traces to produce GB estimates by route and service. Accurate measurement avoids guessing and tightens budget estimates.
-
Enable and export flow logs
Turn on VPC/VNet flow logs and export them to storage or analytics. AWS VPC Flow Logs, Azure NSG flow logs, and GCP VPC Flow Logs include byte counters and network interfaces. Aggregate bytes by source and destination to map traffic by route.
-
Sample packets for heavy hitters
Use sFlow or tcpdump sampling to find top talkers and heavy flows. Sampling reveals which services or instances produce the most outbound bytes. That helps prioritize fixes that yield the largest savings.
-
Correlate application traces and storage logs
Match origin storage access logs with application traces to separate bulk transfers from control traffic. This shows whether repeated egress comes from app design or migration tooling.
Measure one week of normal traffic plus a simulated migration run to capture peak and background flows. Use those numbers as input to the cost model and run sensitivity for 1x, 2x, and 5x delta rates.
Step-by-step measurement checklist
- Enable and export VPC/VNet flow logs to a central analytics or storage location.
- Run one week of normal traffic capture.
- Run a simulated migration pass to capture migration-specific flows.
- Perform sampled packet captures (sFlow/tcpdump) to identify heavy hitters.
- Aggregate bytes by src/dst and by route type (internet, inter‑region, inter‑AZ, peering).
- Correlate aggregated flows with storage access logs and application traces to classify bulk vs control traffic.
- Classify flows into the three buckets: bulk seed, delta syncs, ongoing outbound.
- Estimate GB per route and per bucket, then apply provider egress pricing to produce line items.
- Run sensitivity scenarios (1x, 2x, 5x delta) and prioritize optimizations for the heaviest-cost flows.
Major variables that drive egress costs
The main drivers are route type, provider price tiers, sync frequency, and fixed network fees. These four variables explain most surprises on post‑migration invoices. Work them into every cost model.
Route type and price tiers
Internet egress, inter‑region transfers, and private peering use different meters and price tiers. Providers publish $/GB by tier and route. Use the exact SKU that matches your path when modeling. Internet egress rates often range from $0.01/GB to $0.20/GB depending on provider and tier.
Sync frequency and delta size
Repeated syncs inflate costs more than initial seed size when deltas are large. Count how many sync passes will run and multiply deltas by the provider rate per route. For example, two full passes double the egress cost compared to one.
Fixed fees and break-even points
Private interconnects and appliances carry fixed fees and setup costs. A port fee or appliance rental pays off only if volumes or transfer duration cross a predictable threshold. Calculate break‑even before committing to a fixed cost.
Run real traffic captures before you push live migration.
Typical migration profile: cloud-to-cloud bulk moves
This profile covers moving large datasets between cloud providers or regions where the source bills outbound. It is common for SaaS and data platforms moving archives or databases. The core decision is network transfer versus physical seed.
Cost modeling for a bulk seed
One worked example clarifies the decision. Migrate 100 TB out of AWS where internet egress is $0.09/GB (2024 example). The initial seed egress cost equals 100 TB * 1024 GB/TB * $0.09 ≈ $9,216.
Compare this to appliance services priced around $2,500–$5,000 for shipping and processing.
Repeated syncs and total bill
If the migration requires daily delta syncs of 5 TB over 10 days, add 50 TB of egress. At $0.09/GB that adds roughly $4,608 to the bill. The final egress total becomes $13,824, which may change the chosen method.
Decision triggers for appliance vs network transfer
Pick an appliance when initial TB exceeds the break‑even threshold or when WAN bandwidth would extend the migration timeline unacceptably. For many public cloud moves, the break‑even sits between 20 TB and 200 TB depending on rates and schedule.
Run real traffic captures before you push live migration.
Typical migration profile: phased application cutover
This profile covers incremental moves where services stay online and syncs run continuously. It fits SaaS with low downtime windows. The challenge is minimizing repeated outbound transfers during cutover.
Minimize repeated deltas
Use change-only syncs, checksums, and app-level filters to reduce delta size. For object stores, adopt object‑level checksums and selective replication. Each GB avoided reduces billing directly.
Use edge caching to reduce origin pulls
If a service generates many reads from new regions, put a CDN or cache in front of the origin during migration. Cache hits convert origin egress into cheaper edge retrievals and reduce origin egress costs. This is effective when read distribution is predictable.
Errors and blind spots that cause surprise costs
Several common mistakes cause unexpected egress charges. Catch these before migration to avoid large bills. The most frequent error is modeling only bulk seed and ignoring background traffic and control‑plane calls.
Assuming ingress is free everywhere
Many teams think uploads cost nothing. Public internet ingress is often free, but cross‑region or cloud‑to‑cloud transfers can charge on the source side. Check each provider's ingress and egress rules for the exact route.
Ignoring control‑plane and third‑party
APIs, telemetry, authentication, and third‑party services can create steady outbound traffic. Audit these flows with logs and tracing. This often reveals small, persistent costs that add up over a migration window.
Relying on published rates without validation
Billing can differ from published rates due to tier rounding, metering intervals, and SKU selection. Validate your model by sampling recent bills for the same flow when possible. Vendors sometimes meter at five‑minute intervals, which inflates traffic if bursts are frequent.
Run real traffic captures before you push live migration.
Region-to-region $/GB matrix and worked calculator example
Use a per‑route price matrix and a simple TCO formula to estimate total migration cost. The matrix must reflect internet egress, inter‑region, intra‑region, and private peering rates for involved regions.
Example price matrix
| Route |
AWS ($/GB) |
GCP ($/GB) |
Azure ($/GB) |
| Internet egress (US East) |
0.09 (first 10 TB) |
0.12 (first 1 TB) |
0.087 (first 10 TB) |
| Inter‑region (US East → US West) |
0.02 |
0.01–0.02 |
0.02–0.05 |
| Intra‑region / same AZ |
0.00–0.01 |
0.00–0.01 |
0.00–0.01 |
| Private peering / Direct Connect |
Port fee + ~0.01 |
Port fee + ~0.01 |
Port fee + ~0.01 |
(These numbers are illustrative; confirm the exact SKU on each provider pricing page before a final budget. For AWS pricing see AWS pricing.)
Total Egress Cost = Σ (GB_route * $/GB_route) + fixed fees + labor + rework. Use this formula and run three scenarios: network, appliance, and hybrid.
Worked example for 100 TB AWS → GCP with two passes:
- Initial seed 100 TB = 100 TB * 1024 GB/TB = 102,400 GB * $0.09 = $9,216 (approx).
- Delta syncs 50 TB = 50,000 GB * $0.09 = $4,500 (approx).
- Total egress ≈ $13,500.
- Snowball/appliance option ≈ $3,500–$5,000 total.
This shows a likely savings of $8,500–$10,000 by choosing an appliance for this example.
Run real traffic captures before you push live migration.
Include total TB, number of sync passes, provider $/GB by route, fixed interconnect fees, appliance cost, and labor hours. Run sensitivity for delta sizes of 1%, 5%, and 10% of the dataset.
Regional and multi‑currency worked examples
To make cost planning actionable, add a concise region‑to‑region comparison with USD and EUR examples for common routes. For instance, a representative 2024 illustrative set: US East (N. Virginia) → EU West (Ireland) internet egress ≈ $0.09/GB (~€0.08/GB using ~0.90 EUR/USD). US East → US West inter‑region ≈ $0.02/GB (~€0.018/GB). EU West → Asia Pacific (Tokyo) internet ≈ $0.12/GB (~€0.11/GB). Private peering tends to show port fees plus ~ $0.01/GB (~€0.009/GB) throughput costs after amortization.
Use these worked-route numbers to compare a 50 TB or 100 TB seed across routes and currencies. Convert using a consistent FX rate and note the impact on migration costs and break‑even calculations.
Runnable mitigation snippets and IaC examples
Use short, copy‑paste snippets for common mitigations: CDN, private interconnect, and selective sync. These examples let teams act quickly and test options.
Fast CDN example
Use this minimal AWS CLI example to create a distribution and reduce origin pulls. Set a long cache TTL for static assets during migration.
Bash
aws cloudfront create-distribution --origin-domain-name example-bucket.s3.amazonaws.com /
--default-root-object index.html --default-cache-behavior "{/"ViewerProtocolPolicy/":/"redirect-to-https/",/"MinTTL/":86400}"
Adjust cache policies to cover the objects moved during cutover. This converts origin egress into edge hits and lowers egress costs.
This example outlines creating a hosted connection. Replace placeholders with account values.
Hcl
resource "aws_dx_connection" "dx" {
name = "migration-dx"
bandwidth = "1Gbps"
location = "EqSV5" # example location
provider_name = "AT&T"
}
Remember to add port fees and cross‑connect costs when evaluating total cost.
Efficient object sync commands
Use these commands to limit transferred bytes by excluding unchanged files and using checksums.
Bash
aws s3 sync s3://source-bucket s3://target-bucket --size-only --exclude "*.tmp"
rclone sync source:bucket target:bucket --checksum --transfers 16
These commands cut delta transfer size and reduce repeated egress.
Run real traffic captures before you push live migration.
Saving egress may increase latency or add operational complexity. Quantify tradeoffs using SLOs and a short canary test. The goal is to map business impact to dollars.
Latency versus egress savings
Using a CDN reduces origin egress but may increase time to consistent updates. Decide acceptable staleness and measure it with synthetic tests. If an extra 50 ms is tolerable, CDN often wins on cost.
Replication and availability costs
Every extra replica multiplies replication egress by the replica count. Model incremental cost per replica and compare it to user experience benefits. Often one cross‑region replica suffices for DR while a second replica doubles egress for little gain.
Canary and validation plan
Run a small test migration for 1–5% of data and reconcile predicted egress to actual billing. This validates meters and reduces projection error before a full migration.
Operational experience and vendor case studies report material reductions in unexpected billing after profiling and canary runs. A conservative planning range from multiple teams is a 30–60% reduction in billing variance when hidden flows get uncovered and remediated. Quantify project results by running a 1–5% canary migration and reconciling predicted versus actual egress to set a project‑specific reduction estimate.
This works in practice. It fails when teams test only with synthetic traffic that omits control‑plane or third‑party flows.
Real cases, numbers saved, and templates
Real migrations show what works and what fails. Use anonymized examples to choose tactics that fit your situation.
SaaS multi‑region migration
Before migration, 50 TB of nightly DB and binary syncs generated about $4,500/month in cross‑region egress. After mitigation, selective replication, private peering, and caching cut egress by 78%. Monthly cost fell to $990. The team avoided a multi‑week outage and reduced monthly spend immediately.
A 200 TB archive transfer had a network estimate of $18,000 for internet egress. Choosing an appliance and checksum validation lowered transfer cost to $6,500 and shortened the window from four weeks to ten days. The migration completed with no data loss.
Runbook and checklist template
Use this short runbook during planning and execution:
- Inventory flows and enable flow logs.
- Measure one week of normal traffic plus a simulated run.
- Build a per‑route $/GB matrix and run three scenarios.
- Decide: appliance, interconnect, or network.
- Implement caching and selective syncs.
- Run a 1–5% canary and reconcile billing.
- Execute full migration and monitor billing daily for anomalies.
Run real traffic captures before you push live migration.
Practical decision paragraph
Use measured per‑route GB estimates and the break‑even calculator to decide the transfer method. For one full seed larger than appliance break‑even, choose physical import. For many small repeated deltas, invest in peering and caching. This recommendation works in most cases but not when migration size is extremely small or when a provider gives credits that cover outbound traffic.
Do not apply the appliance or interconnect recommendation when the total migration is under 100 GB, when the migration stays inside the same region or AZ, or when a provider gives explicit egress credits for migration. In those cases the overhead of private peering or appliance logistics can cost more than network transfer.
If a budget needs validation, run the calculator with measured flow‑log numbers and compare the appliance and interconnect scenarios before ordering capacity.
The plan: what to do next
Start with measurement, then model, then choose a migration method. Measurement reduces uncertainty and prevents surprise charges. The checklist below helps prioritize actions.
- Enable flow logs and export them for analysis.
- Run a one‑week traffic profile and a small simulated migration.
- Populate the per‑route $/GB matrix using provider SKUs.
- Run the break‑even calculator for appliance vs network.
Run real traffic captures before you push live migration.
Template calculator
Copy these columns into a spreadsheet to run the model:
Route,GB,Price_per_GB,Cost
Initial seed,102400,0.09,=B2C2
Delta syncs,51200,0.09,=B3C3
Interconnect fee,1,3500,=C4
Total,, ,=SUM(D2:D4)
Monitor and validate
Reconcile predicted costs with actual billing daily during the migration. Tag resources to trace billing lines back to flows. If actual egress exceeds estimates by more than 20%, pause and audit logs for hidden flows.
Example numbers: 100 TB seed at $0.09/GB ≈ $9,000 (2024), a common Direct Connect port fee can be several hundred to a few thousand dollars monthly (vendor dependent), and appliance import services often cost between $2,500 and $6,000 for multi‑TB jobs. Use these numbers as starting points for the break‑even calculation.
Downloadable spreadsheet / calculator
Include a downloadable spreadsheet example that implements the TCO formula with explicit cells and formulas so teams can paste measured flow logs directly. Columns: Route | TB (or GB) | GB (use =IF(A2="TB",B21024,B2) to normalize) | Price_per_GB | Cost (formula =C2D2). Add summary rows: Total_Egress =SUM(E:E), Appliance_Cost (manual entry), Interconnect_Fee (manual), BreakEven_Network_vs_Appliance =IF(Appliance_Cost>0,Appliance_Cost/Price_per_GB,""). A worked output: for 100 TB seed (102,400 GB) at $0.09/GB the sheet should show $9,216 egress; add delta passes as additional rows and a sensitivity table for delta sizes of 1%, 5%, 10%.
This concrete calculator structure converts measured bytes into cost and an explicit break‑even analysis for appliance versus network transfer.
Frequently asked questions
