Comparison
Cross-zone traffic costvsEast-west traffic
Cross-zone traffic cost
spreading replicas across zones for resilience quietly added a per-gigabyte charge to every internal call between them.
The charge for data moving between availability zones inside a region, applied in both directions on many providers. It is invisible in architecture diagrams and material for chatty services, replicated databases and meshes that route without regard to topology. Zone-aware routing — preferring a local endpoint when one is healthy — is the standard mitigation, and it trades some balance for a real saving.
Full entry →East-west traffic
one internal service calling another, which is most of your packets and historically none of your authentication.
Traffic between services inside the boundary. In a microservice estate it dwarfs the north-south volume, and it was traditionally unauthenticated and unencrypted on the assumption that the network was trusted. Making it verified — workload identity, mutual TLS, per-call policy — is precisely what a service mesh and a zero-trust posture are for, and it is why anything compromised inside the perimeter used to be able to reach everything.
Full entry →