How to Reduce Egress Costs (CDN & WAF)

Egress (data transfer out) is often one of the largest and most controllable parts of a cloud bill. Using a CDN and, where it makes sense, a WAF can cut egress from origin and reduce bandwidth cost. This guide covers practical patterns for AWS, GCP, and Azure. For a full cost audit see our FinOps audit (2026) and cloud cost optimization checklist.

Why egress hurts

Cloud providers charge for data leaving their network (and often more for cross-region or internet egress). High traffic to users, APIs, or downloads can make egress the second-biggest line item after compute. Reducing bytes served from origin directly reduces that cost.

CDN: cache at the edge

Put static assets (and cacheable API responses) behind a CDN so users are served from edge locations. Origin egress drops because only cache misses and dynamic content hit your cloud. Use:

• AWS: CloudFront in front of S3/ALB/EC2
• GCP: Cloud CDN with Load Balancing
• Azure: Azure CDN or Front Door

Set cache TTLs and invalidation rules so fresh content is still correct. Many managed hosts (e.g. Cloudways) offer Cloudflare or similar as an add-on.

WAF and edge logic

A WAF (Web Application Firewall) at the edge can block bad traffic before it reaches origin, reducing unnecessary egress and load. Use WAF rules to throttle or block bots, known bad IPs, and attack patterns. Less junk traffic means less origin egress and lower compute load.

Other levers

• Keep traffic in-region where possible (same-region egress is often cheaper or free).
• Compress responses (gzip/Brotli) to reduce bytes transferred.
• Review and trim unnecessary cross-region or vendor-to-vendor transfer.