Beware of Edge Caching. Lower Egress Costs, But Increased GCP Monthly Bills?

Installing Cloud CDN in front of Google Cloud Storage (GCS) under the assumption that caching will definitely save data transfer (egress) costs. In theory, the per-gigabyte price of a CDN Cache Hit is indeed much cheaper than Direct GCS Egress.

However, in practice, don’t be surprised when you see a monthly Google Cloud Platform (GCP) billing cost component actually inflate.

Why does this happen? The answer lies in hidden infrastructure fixed costs and the access patterns of the cached files. This article breaks down, both technically and mathematically when Edge Caching truly saves your budget and when it turns into unnecessary overhead.

*disclaimer, compoment GCP cost may no longer be updated or not match with your region. Please refer to the official GCP documentation.

Previously, I discussed compared stream architecture and signed URLs GCS here: https://medium.com/@lukman.bahar.ap/signed-urls-as-the-default-architecture-for-large-file-delivery-in-google-cloud-storage-7ddf1fc1ceef

By default, the simplest architecture for serving files from GCS to users follows this workflow:

Challenges with Direct GCS:

• Zero Caching: If 1,000 users download the exact same file (e.g., a user manual or product catalog), GCS processes 1,000 separate requests directly against the storage bucket.
• High Egress Rates: Direct egress from GCS to the public internet (especially in regions like Jakarta/APAC) sits at the highest pricing tier (~$0.19/GB).

*disclaimer, compoment GCP cost may no longer be updated or not match with your region. Please refer to the official GCP documentation.

The Theoretical Solution: Edge Caching via Cloud CDN

To address egress costs, the architecture is modified by placing Cloud CDN in front of the GCS Bucket. Download requests are absorbed by the nearest Edge Location:

The Hidden Cost: Why CDN Can Increase Your Bill?

Cloud CDN in GCP cannot stand alone. To enable Cloud CDN in front of a GCS Bucket, you must attach it to a Global External Application Load Balancer (ALB).

This introduces two key cost drivers:

• Fixed ALB Rental Cost: Global Load Balancers incur a minimum hourly charge, coming out to roughly ~$18 to $25+ per month just for the base instance, excluding per-GB data processing fees.
• Cache Miss Overhead: When a user requests a new or uncached file, you pay for Cache Fill (data transfer from GCS to CDN) + CDN Egress + Load Balancer Data Processing.

Comparasion: Direct GCS vs. Cloud CDN

Here is a mathematical comparison across two common scenarios:

Adding Cloud CDN is not always cheaper for every scenario. The primary reason is that Cloud CDN requires a Global External Application Load Balancer (ALB), which incurs a fixed monthly rental cost (~$18–$25/month).

Here is a decision matrix to determine which approach is more cost-efficient:

Scenario A: Transactional / Unique Files (Zero Cache Hit)

Consider an application serving invoice PDFs, ID verification photos, or medical records. These files are highly private and downloaded by a single owner only 1–2 times.

Traffic: 10 GB per month of unique files:

Result: Adding a CDN in this scenario inflates the bill nearly 10x ($18.90 vs. $1.90) because the Cache Hit Ratio is near 0%.

Scenario B: Frequently Accessed Files (High Cache Hit Ratio)

Consider an application serving user guides, product catalogs, or video modules accessed repeatedly by thousands of users.

Traffic: 1 Terabyte (1,000 GB) per month with high repeat reads.

Result: At this scale, the lower per-GB egress rate easily offsets the fixed Load Balancer cost, saving ~$82 / month (~43% reduction).

Which One Should You Choose?

Before enabling Cloud CDN in the Google Cloud Console, evaluate your architecture against two questions:

1. Are files accessed repeatedly by multiple users?

• Yes: Use Cloud CDN
• No (Unique/Private Files): Use Direct GCS

2. Is your monthly transfer volume high enough to cover the Load Balancer fee ($18–$25/month)?

• Yes: CDN will lower your overall bill.
• No: Direct GCS without a Load Balancer remains significantly cheaper.

Understanding infrastructure trade-offs and hidden costs ensures you build systems that are not only technically robust, but also financially efficient.

this mapping condition maybe help you to choose :

✅ USE A CDN (Cloud CDN + ALB) IF:

• High-Density Repeat Reads (High & Repeated Traffic): Semi-public or public assets — such as product photos, paid course video modules, or app banner images — that are fetched thousands of times by many different users.
• Spiky / Flash-Sale Traffic (Massive Access in a Short Window): Documents or media downloaded simultaneously by thousands of users within a brief timeframe (even if the file goes dormant afterward). The CDN absorbs the traffic burst, preventing your GCS bucket from hitting rate limits.
• Multi-Region / Global Users: Your app’s users are distributed across multiple countries or continents, making CDN Edge Locations crucial for reducing download latency.

❌ DO NOT USE A CDN (Direct GCS Signed URLs are Better) IF:

• 1-to-1 Private Files (Unique File per User): Invoice PDFs, ID verification scans, or medical reports. The file belongs to a single user and is downloaded only once or twice, resulting in a Cache Hit Ratio near 0%.
• Low-Frequency / Long-Tail Access (Very Rarely Downloaded): Legacy archive files accessed only 2 to 5 times a month. These files will constantly suffer from Cache Eviction at the CDN Edge server, resulting in repeated Cache Misses.
• Overall Egress Traffic Volume is Small (< 100–200 GB/month): If your application’s total monthly data transfer is still low, the per-GB egress discount offered by the CDN will never offset the fixed monthly rental cost of a Global Load Balancer (~$18–$25/month).
• Bound by Strict Regional Compliance / Regulations: If compliance regulations prohibit Global Routing or Global ALBs and require all traffic to stay strictly within a specific region (e.g., restricted entirely to the Jakarta asia-southeast2 region).

Keeping Files Secure ?

To ensure private files do not become publicly accessible when cached, use Cloud CDN Signed URLs or Signed Cookies. Remember, Understanding infrastructure trade-offs!