Cutting Cloud Costs Without Degrading Latency: A 4-Step FinOps Strategy for Multi-AZ Egress
In large-scale US cloud deployments, cross-AZ traffic often accounts for 15% to 25% of total infrastructure spend. Standard Kubernetes deployments schedule pods across failure zones for high availability, but without traffic locality, simple service-to-service RPC calls rack up unnecessary per-gigabyte transfer fees and cross-datacenter latency penalties.


Here is a practical guide to re-architecting your internal routing for network cost efficiency without compromising fault tolerance.


1. Enforce Kubernetes Topology-Aware Routing
By default, kube-proxy distributes service traffic evenly across all ready endpoints, regardless of zone.


The Problem: A pod in us-east-1a making a call to a service often hits a pod in us-east-1b, incurring cross-AZ egress costs and adding 1–2ms of latency.


The Fix: Enable topology-aware routing in your Service manifests:


YAML
apiVersion: v1
kind: Service
metadata:
name: order-service
annotations:
service.kubernetes.io/topology-mode: Auto
spec:
trafficDistribution: PreferClose
This forces the control plane to route requests to endpoints residing within the same AZ, keeping traffic local unless a zone failure triggers automatic cross-zone failover.


2. Route S3 and DynamoDB via Gateway VPC Endpoints
One of the most common configuration misses is letting microservices communicate with object storage over public NAT Gateways.


NAT Gateways charge both an hourly rate and a per-GB data processing fee, plus standard internet data transfer charges.


Provision an AWS Gateway VPC Endpoint for Amazon S3 and DynamoDB directly inside your route tables.


Traffic routes over private AWS backbone networking with zero data processing charges and zero NAT Gateway egress fees.


3. Consolidate State Transfer with Read Replicas per Zone
If your architecture relies heavily on centralized caches (e.g., a Redis cluster in us-west-2a), every read from services in us-west-2b and us-west-2c traverses the zone boundary.


Place local read replicas in each active zone for high-read, low-write data patterns.


While you pay cross-AZ replication costs once on the write path, you save millions of cross-zone roundtrips on high-frequency read operations.


4. Continuous Network Telemetry via VPC Flow Logs
You cannot optimize what you do not trace.


Enable VPC Flow Logs with custom format fields (srcaddr, dstaddr, pkt-srcaddr, pkt-dstaddr, action).


Query your flow logs using Athena or BigQuery to identify which microservices account for the top 5% of cross-subnet bytes transferred.


Target those specific service pairs for pod affinity or colocation in your next deployment sprint.


Key Takeaways


Keep Service RPCs Local: Use service.kubernetes.io/topology-mode: Auto or trafficDistribution: PreferClose to keep traffic within the same AZ.


Bypass NAT Gateways: Route S3 and managed database traffic through Gateway VPC Endpoints to eliminate data processing fees entirely.


Locality-First Reads: Distribute cache read replicas into active zones to swap recurring read egress for single-pass write replication.


Profile Flow Logs: Run Athena queries on VPC flow logs monthly to catch new chatty cross-zone service dependencies before billing closes.


CTA


Navigating multi-region scale, FinOps pipelines, and modern cloud architecture across the US tech scene?


Join Techawks USA to exchange battle-tested system designs, production playbooks, and cost-efficiency architectures with leading backend engineers and infrastructure leads. Link in the comments.