What does 'Compute Engine Network Internet Egress' mean to Google Cloud?

Question

I've started a simple Tomcat webserver in Google Cloud Platform, this month I was charged for a service called 'Compute Engine Network Internet Egress from Americas to China: 2636.552 Gibibyte (Project:xxx)' and for the service 'Compute Engine Network Internet Egress from Americas to Americas'.

What does 'Compute Engine Network Internet Egress from America to China' really mean?

Solution

Just to make sure we're on the same page regarding terminology:

• ingress: traffic entering or uploaded into Google Cloud Platform
• egress: traffic exiting or downloaded from Google Cloud Platform

As you can see from the Google Cloud Platform network pricing page, ingress traffic is free, while egress traffic is charged based on the source and destination of such traffic.

So in your examples:

Compute Engine Network Internet Egress from Americas to China [...]

means that your data, stored in Americas in Google Cloud Platform, was downloaded from China.

Compute Engine Network Internet Egress from Americas to Americas [...]

means that your data, stored in Americas in Google Cloud Platform, was downloaded from Americas.

If this was not expected or intended, i.e., you wanted to run a private server, it's possible that these are just bots hitting your server and downloading every possible HTML page, image file, clicking on every link, etc. This means that you should put some authentication/authorization in front of your Tomcat server to make sure that it's not automatically crawled or attacked by every bot out there that just scans all IPs and attempts to connect to every port in the hopes of downloading useful data.

Consider IP filtering as well, or a firewall configuration which does not respond to requests from IP ranges you won't expect to use your service. Again, remember that ingress traffic is free, so as long as you don't generate any outbound traffic for a given request, you won't be charged.

Note that you can stop good, standards-abiding web crawlers using /robots.txt approach, but you still need to protect your service from the not-so-good actors.

Comments

[Admin]

This question appears to be off-topic because it is about Google's pricing system

[jww]

Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See What topics can I ask about here in the Help Center. Perhaps Web Applications Stack Exchange, Webmaster Stack Exchange or Unix & Linux Stack Exchange would be a better place to ask.

[Jigar Navadiya]

If you have compute instance which intended to serve to global traffic (worldwide users), then what should be the configuration of GCE? So basically, how can one avoid egress charges for global website?

[Misha Brukman]

@JigarNavadiya — if you intend to serve traffic to users, then you have to pay for that network egress. If you block all egress (or ingress) traffic, then your website won't serve any users. My suggestions were about blocking unwanted egress traffic. If that does not address your question, please create a new question with more details and context.

[Amit Singh]

@MishaBrukman If we are moving data outside GCP into say another cloud platform, say S3, will that be counted as network egress?

[Misha Brukman]

@AmitSingh — yes, any movement of data outside of GCP is considered "egress" regardless of the destination.

[forresthopkinsa]

For anyone looking to add firewall rules to block Chinese connections, I posted exactly that here

[WinEunuuchs2Unix]

So the first thing to do setting up a webstie on GCP is to block users from certain regions from signing on too often to view web pages? You get 1 GB of egress free per month. For all I know I have to block Google in China from accessing my Google website hosted in Iowa for free. I think GCP should provide the tools to protect against DDOS and Users / Bots out of region, etc.