All networking pricing

This page describes pricing for networking products.

Virtual Private Cloud

The following prices are applied both during and after the Google Cloud Free Trial period. During the Free Trial period, these prices are charged against the Free Trial credit amount.

General network pricing information

Ingress traffic

Traffic coming in to a Google Cloud resource, such as a VM. If you send traffic between two VMs, then the traffic is counted as egress traffic as it leaves one VM and counted as ingress traffic as it arrives at the other VM.

Egress traffic

Traffic leaving a Google Cloud resource, such as a VM, hosted in a Google region. For egress purposes, a region is a set of buildings operated by Google in a geographic location, such as a data center campus. Traffic can travel as follows:

• Within the set of buildings at the location, which always used Google's network (intra-zone and intra-region pricing)
• To another building operated by Google in another location, which always used Google's network (inter-region pricing)
• To a location not operated by Google over a Cloud Interconnect connection (Cloud Interconnect pricing)
• To a location not operated by Google not over a Cloud Interconnect connection (internet egress pricing)

Traffic leaving Google's network is always internet egress or Cloud Interconnect, regardless of the geographic location of the non-Google destination.

Egress traffic is charged based on whether the traffic uses an internal or external IP address, whether the traffic crosses zone or region boundaries within Google Cloud, whether the traffic leaves or stays inside Google Cloud, and the network tier of traffic that leaves Google's network. When two resources communicate with each other, there are two traffic paths—one in each direction. Traffic in each direction is designated as egress at the source and ingress at the destination, and each direction is priced accordingly.

Premium Tier

The Network Service Tiers Premium Tier leverages Google's premium backbone to carry traffic to and from your external users. The public internet is usually only used between the user and the closest Google network ingress point.

Standard Tier

The Network Service Tiers Standard Tier leverages the public internet to carry traffic between your services and your users. While using the public internet provides a lower quality of service, it is more economical than Premium Tier.

Ingress pricing

Traffic type	Price
Ingress	No charge for ingress traffic. However there may be a charge for resource that processes ingress traffic. Services that process ingress traffic are as follows: Load balancers Cloud NAT Protocol forwarding Responses to requests count as egress and are charged.

VM-VM egress pricing within Google Cloud

This section covers traffic that leaves a Google Cloud VM and travels to another Google Cloud VM. The cost is attributed to the project of the VM that is sending the traffic. This pricing affects Compute Engine VMs, Google Kubernetes Engine (GKE) nodes, and VMs running App Engine flexible environment.

The following prices are applied both during and after the Google Cloud Free Trial period. During the Free Trial period, these prices are charged against the Free Trial credit amount.

Traffic type	Price
Egress to the same Google Cloud zone when using the internal IP addresses of the resources^1	No charge
Egress to a different Google Cloud zone in the same Google Cloud region when using the internal IP addresses^1 (per GiB)	$0.01
VM-to-VM egress when both VMs are in the same Google Cloud region, regardless of zone, when using the external IP addresses (per GiB)	$0.01
VM-to-VM egress when both VMs are in different regions of the same network using internal or external IP addresses	See the rest of this table.
Egress from a Google Cloud region in the US or Canada to another Google Cloud region in the US or Canada (per GiB)	$0.01
Egress between Google Cloud regions within Europe (per GiB)	$0.02
Egress between Google Cloud regions within Asia (per GiB)	$0.05
Egress between Google Cloud regions within South America (per GiB)	$0.08
Egress between Google Cloud regions within Oceania (per GiB)	$0.08
Egress to a Google Cloud region on another continent (excludes Oceania) (per GiB)	$0.08
Egress from Indonesia or Oceania^2 to any other Google Cloud region (per GiB)	$0.15
Egress from any other Google Cloud region to Indonesia or Oceania^2 (per GiB)	$0.15

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

¹The prices are used regardless of network or subnet. The price for traffic within a zone using internal IP addresses is the same even if the traffic is to a different subnet or network. The price on traffic between zones in the same region is the same if the two instances are in the same subnet, different subnets, or different networks. Pricing is the same whether the instances are in a VPC network or a legacy network.

² Oceania includes Australia, New Zealand, and surrounding Pacific Ocean islands such as Papua New Guinea and Fiji. This region excludes Hawaii.

VM-to-Google service

This section covers traffic that leaves a Google Cloud VM and travels to a Google service. The cost is attributed to the project of the VM that is sending the traffic. This pricing affects Compute Engine VMs, Google Kubernetes Engine nodes, and VMs running App Engine flexible environment.

The following prices are applied both during and after the Google Cloud Free Trial period. During the Free Trial period, these prices are charged against the Free Trial credit amount.

Traffic type	Price
Egress to specific Google products such as Gmail, YouTube, Google Maps, DoubleClick, and Google Drive, whether from a VM in Google Cloud with an external IP address or an internal IP address.	No charge
Egress to a different Google Cloud service within the same region using an external IP address or an internal IP address, except for Memorystore for Redis, Filestore, GKE, and Cloud SQL.	No charge
Egress from Compute Engine and GKE to Cloud CDN and Media CDN.	No charge (cache fill might apply for Cloud CDN).
Egress to Memorystore for Redis, Filestore, Cloud SQL, and Google Kubernetes Engine within the same region is priced the same as VM-to-VM traffic.	VM-VM egress pricing within Google Cloud
Egress to a Google Cloud service in a different region.	VM-VM egress pricing within Google Cloud
For Cloud Spanner network pricing, see Cloud Spanner pricing.
For Cloud Storage network pricing, see Cloud Storage pricing.

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Internet egress rates

Premium Tier pricing

Premium Tier is the default tier for all Google Cloud egress. To use Standard Tier, you must specify it explicitly.

The following prices are applied both during and after the Google Cloud Free Trial period. During the Free Trial period, these prices are charged against the Free Trial credit amount.

Note: The monthly usage is counted by each SKU, while the "Wordwide Destinations" may contain multiple SKUs. For more information, see Google Cloud SKUs.

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

^*These rates do not apply for Cloud CDN, CDN Interconnect, Carrier Peering, Direct Peering, and Cloud Interconnect traffic. Instead, see pricing for Cloud CDN, CDN Interconnect, Carrier Peering, Direct Peering, or Cloud Interconnect.

Standard Tier pricing

Egress pricing is per GiB delivered. Pricing is based on source geolocation of traffic. Ingress pricing is still free. Always Free usage limits do not apply to Standard Tier.

Standard Tier pricing took effect at beta and remains in effect.

Contact sales for pricing beyond 500 TiB.

Internal IP address pricing

There is no charge for static or ephemeral internal IP addresses.

External IP address pricing

You are charged for static and ephemeral external IP addresses according to the following table.

If you reserve a static external IP address and do not assign it to a resource such as a VM instance or a forwarding rule, you are charged at a higher rate than for static and ephemeral external IP addresses that are in use.

You are not charged for static external IP addresses that are assigned to forwarding rules.

You are not charged for external IPv6 address ranges that are assigned to subnets or for external IPv6 addresses that are assigned to VM instances. You are not charged for static regional IPv6 addresses (Preview).

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

In use or not

Google Cloud considers a static external IP address as in use if it is associated with a VM instance whether the instance is running or stopped. If the instance is deleted or if the IP address is dissociated from the instance, Google Cloud considers the static IP address as not in use.

For an ephemeral IP address, Google Cloud considers the address as in use only when the associated VM instance is running. When the instance is stopped or deleted, Google Cloud releases the ephemeral IP address and no longer considers it as in use.

You can check whether a static external IP address is in use by making a gcloud compute addresses list request. This command returns a list of static external IP addresses and their statuses:

gcloud compute addresses list

NAME          REGION  ADDRESS        STATUS
address-1             130.211.8.68   IN_USE
address-2             35.186.217.84  RESERVED

In this example, IPv4 address-1 is in use while IPv4 address-2 is reserved but not being used. Both addresses are charged according to the External IP address pricing table in this document.

Note: If the same IP address is assigned to more than one forwarding rule, Google Cloud counts and adds each usage of the address towards the IN_USE_ADDRESSES quota rather than a unique count of IP address objects that are used.

Firewall rules

For Cloud Firewall pricing, see the Cloud Firewall pricing page.

Private Service Connect

The costs associated with Private Service Connect vary depending on the configuration.

Using a Private Service Connect endpoint (forwarding rule) to access Google APIs

Item	Price per hour (USD)	Price per GiB processed, both egress and ingress (USD)
Private Service Connect endpoint (forwarding rule) used to access Google APIs	$0.01	No data charge

Using a Private Service Connect backend (load balancer) to access Google APIs

Private Service Connect backends use a load balancer to access Google APIs. All load balancer pricing applies. Traffic to Private Service Connect NEGs that is directed to Google APIs incurs load balancing charges for data processed by load balancer. However, there is no Private Service Connect charge for ingress or egress traffic between the Private Service Connect NEG and Google APIs.

For pricing information for your load balancer, see pricing for global external HTTP(S) load balancer or internal HTTP(S) load balancer pricing.

Note: Private Service Connect backends were previously referred to as Private Service Connect endpoints with consumer HTTP(S) service controls.

Using a Private Service Connect service attachment to publish a managed service

Item	Price per hour (USD)	Price per GiB processed, both egress and ingress (USD)
Private Service Connect service attachment used by a service producer to provide access to services	No hourly charge	$0.01

Services that are published using Private Service Connect can be hosted on the following load balancers:

• Internal TCP/UDP load balancer: For pricing information, see Load balancing and forwarding rules.
• Internal HTTP(S) load balancer: For pricing information, see Internal HTTP(S) load balancer.
• Internal protocol forwarding: For pricing information, see Protocol forwarding.
• Internal regional TCP proxy load balancer:
  • Pricing for Preview: Internal regional TCP proxy load balancer used with Private Service Connect is offered without charge until it reaches General Availability.
  • Pricing for General Availability: Internal TCP/UDP load balancer pricing applies for internal regional TCP proxy load balancer at General Availability. For pricing information, see Load balancing and forwarding rules.

Note: If resources use an endpoint with global access to access a published service from a different region than the service, the service producer project is not charged inter-regional egress. For information about service consumer project charges, see Using a Private Service Connect endpoint (forwarding rule) to access a published managed service.

Using a Private Service Connect endpoint (forwarding rule) to access a published service

Item	Price per hour (USD)	Price per GiB processed, both egress and ingress (USD)
Private Service Connect endpoint (forwarding rule)	$0.01	$0.01 For endpoints with global access, when the endpoint is accessed by resources in other regions, inter-regional egress charges also apply to that traffic.

Note: For endpoints with global access, the service producer project is not charged inter-regional egress even if service consumer resources are accessing the endpoint from other regions.

Using a Private Service Connect backend (load balancer) to access a published service

Private Service Connect backends use a load balancer to access published services. All load balancer pricing applies. Traffic between Private Service Connect NEGs and Private Service Connect published services incurs both load balancing charges for data processed by load balancer and Private Service Connect charges for ingress and egress traffic between the NEG and the published service.

The following table summarizes the applicable charges for this configuration.

Item	Price (USD)
Private Service Connect endpoint (load balancer) used to access services in another VPC network	All global external HTTP(S) load balancer or internal HTTP(S) load balancer pricing applies
Traffic between a Private Service Connect NEG and the published service	$0.01 per GiB processed, both egress and ingress

Deploying a service by using service connection maps

When you deploy a service by using service connection maps, there are no charges for the deployment itself. However, you are charged for the following:

• Resources that are deployed through service connectivity automation
• Using a Private Service Connect endpoint to access a published service

Private services access

When you create a private services access connection, there are no hourly or data charges for the connection itself. However, you are charged for the following:

• Resources that you provision in the service producer's network
• Egress traffic from your VMs to the service producer's network

Serverless VPC Access

Serverless VPC Access is priced as follows.

Resource	Price
Serverless VPC Access connector	Charged by the number of instances in your connector. See the pricing for your instance type: f1-micro: N1 shared-core machine types e2-micro: E2 shared-core machine types e2-standard-4: E2 standard machine types
Network egress	Charged at Compute Engine networking rates. Serverless VPC Access connector instances are distributed across zones for increased reliability. The rate is based on which connector instance handles the request and whether the destination resource is in the same zone. Egress to a connector from a serverless resource such as a function, app, or service is not charged.

You can view your Serverless VPC Access costs in the Google Cloud console by filtering your billing reports by the label key serverless-vpc-access.

Network telemetry

Network logs generate charges. You are charged for the following products:

• VPC Flow Logs
• Firewall Rules Logging
• Cloud NAT logging

Log generation	Price (USD)
0—10 TiB per month	0.50/GiB
10—30 TiB per month	0.25/GiB
30—50 TiB per month	0.10/GiB
>50 TiB per month	0.05/GiB

Logs are sent to Cloud Logging. Logs can be further exported to Pub/Sub, Cloud Storage, or BigQuery. Pub/Sub, Cloud Storage, or BigQuery charges apply in addition to log generation charges. For more information on exporting logs, see Overview of logs export.

If you store your logs in Cloud Logging, logs generation charges are waived, and only Logging charges apply.

If you send and then exclude your logs from Cloud Logging, log generation charges apply.

Packet Mirroring

You are charged for the amount of data processed by Packet Mirroring. You are not charged for Packet Mirroring forwarding rules. Currently, there is no additional per-VM charge for using Packet Mirroring. The costs for the data processed by Packet Mirroring are described in the following table.

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Normal egress rates are charged for traffic outbound from a load balancer. There is no additional load balancer egress cost beyond normal egress rates.

Cloud Load Balancing

Load balancing and forwarding rules

The pricing tables in this section apply to all types of load balancers other than internal HTTP(S) load balancers. For internal HTTP(S) load balancers, see the Internal HTTP(S) load balancer section.

For Private Service Connect forwarding rules, see the Private Service Connect section.

Important: Starting August 1, 2023, you'll see several changes to the Cloud Load Balancing SKUs. Currently, SKUs for Cloud Load Balancing usage are categorized under Compute Engine. With this change, we've removed the Cloud Load Balancing SKUs from their existing Compute Engine product category and created new SKUs in the Networking category (launched on June 1, 2022).

While most SKUs have a 1:1 mapping to the new SKUs, certain SKUs have been split so that they are consistent across all load balancer types. For example, some data processing SKUs are being split into separate inbound and outbound SKUs. The prices for these SKUs have not changed, and your total charges won't change either. For more details, see Announcement of upcoming SKU changes for Cloud Load Balancing.

The following table shows the pricing for global forwarding rules. There are no global data processing charges. Data processing is charged by the region, depending on where the traffic is processed.

Item	Price per unit (USD)	Pricing unit
First 5 forwarding rules	$0.025	Per Hour
Per additional forwarding rule	$0.01	Per Hour

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

The following table shows regional forwarding rule charges and inbound and outbound data processing charges by region.

^* To see the SKUs associated with this charge, see the full pricing announcement for Outbound data processing charges.

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Ways to lower external HTTP(S) load balancer costs

Global external HTTP(S) load balancer users can use Google Cloud Armor, Cloud CDN, or both, to minimize the impact of Outbound data processing charges.

• Cloud CDN: Static objects that are served to the client from the cache do not transit through the load balancer. An effective caching strategy would reduce the amount of outbound data being processed by the load balancer and lower your costs. To implement caching, it is necessary to understand which portion of your traffic is static and cacheable. For additional information, refer the Cloud CDN documentation.

• Google Cloud Armor: If your application receives a significant amount of undesirable traffic, you can deploy Google Cloud Armor to block such traffic. Requests that are blocked by Google Cloud Armor do not transit through the load balancer, effectively reducing the amount of outbound data processed by the load balancer. The impact on your costs depends on the percentage of undesirable traffic blocked by the Google Cloud Armor security policies you've implemented.

If your application can operate in a single region or is required to operate in a single region, you can use the Regional external HTTP(S) load balancer. The regional external HTTP(S) load balancer uses only the Standard Network Tier which has lower egress charges making it a cost effective option.

External HTTP(S) load balancer pricing with Serverless NEGs

If you are using serverless NEG backends for an external HTTP(S) load balancer (global, regional, or classic), existing load balancer charges will apply in addition to the serverless compute charges for Cloud Run, Cloud Functions, or App Engine backends as applicable. If Google Cloud Armor or Cloud CDN are used, their respective charges also apply.

However, you will not be charged for both serverless egress and Internet egress. Only Internet egress rates apply. Cloud Functions outbound data (egress) charges, App Engine outgoing network traffic charges and Cloud Run egress charges do not apply to requests passed from an external HTTP(S) load balancer (using serverless NEGs) to a Cloud Functions, App Engine, or Cloud Run service.

Cross-project service referencing with Shared VPC

For data processing charges, the forwarding rule project is charged.

Forwarding rules pricing examples

Google Cloud charges for forwarding rules whether they are created for load balancing or other uses, such as Packet Mirroring.

The following examples use US pricing:

You can create up to 5 forwarding rules for the price of $0.025/hour. For example, if you create one forwarding rule, you are charged $0.025/hour. If you have 3 forwarding rules, you are still charged $0.025/hour. However, if you have 10 forwarding rules, you are charged as follows:

• 5 forwarding rules = $0.025/hour
• Each additional forwarding rule = $0.01/hour

$0.025/hour for 5 rules + (5 additional rules * $0.01/hour) = $0.075/hour

For most load balancing use cases, you need only one forwarding rule per load balancer.

Google Cloud charges for global forwarding rules and regional forwarding rules separately, and also per project. For example, if you use one global forwarding and one regional forwarding rule in two separate projects (four rules total), you are charged $0.10/hour (4 x $0.025/hour).

Estimating load balancing charges

To estimate load balancing charges:

1. Go to the Pricing Calculator.
2. On the Cloud Load Balancing tab.
3. From the dropdown menu, select a region.
4. Enter your estimated number of forwarding rules.
5. Enter your monthly estimated amount of network traffic processed.

For example:

• Iowa
• Number of forwarding rules: 10
• Inbound data processed by load balancer: 2,048 GiB
• Total Estimated Cost: USD 71.13 per 1 month

This example doesn't include the Internet egress cost of sending replies from the backends.

Internal HTTP(S) load balancer

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

^* Internal HTTP(S) load balancers use a fleet of managed proxy instances that are dynamically allocated to your network to handle traffic volume. The per proxy instance charge is determined based on the number of proxy instances required to handle your traffic over a specific time period.

Proxy instance charge

An internal HTTP(S) load balancer is a proxy-based load balancer. The load balancer automatically scales the number of proxies available to handle your traffic based on your traffic needs. The proxy instance charge is based on the number of proxy instances needed to satisfy your traffic needs. Each additional proxy incurs an additional hourly charge according to the prices indicated in the previous table.

The number of proxies is calculated based on the measured capacity needed to handle your traffic over a 10-minute time period. During this time period, we look at the greater of:

• The number of proxies needed to serve your traffic's bandwidth needs. Each proxy instance can handle up to 18 MB per second. We monitor the total bandwidth required and divide that total by the bandwidth that a proxy instance can support.
• The number of proxies needed to handle connections and requests. We count the total of each of the following resources and divide each value by what a proxy instance can handle:
  • 600 (HTTP) or 150 (HTTPS) new connections per second
  • 3,000 active connections
  • 1,400 requests per second*

*A proxy instance can handle 1,400 requests per second if Cloud Logging is disabled. If you enable Logging, your proxy instance can handle fewer requests per second. For example: logging 100% of requests decreases the proxy's request handling capacity to 700 requests per second. You can set Logging to sample a smaller percentage of traffic. This enables you to meet your observability needs while controlling your cost.

Example calculation

In a 10-minute period, 180 MB per second of data pass through the load balancer. 180 MB per second / 18 MB per second per proxy instance = 10 proxy instances

During this same period, 300 new HTTPS connections are established per second, 3,000 connections are active and 2,800 requests are sent per second:

300 new HTTPS connections per second / 150 new HTTPS connections per second per proxy instance = 2 proxy instances 3,000 active connections / 3,000 active connections per proxy instance = 1 proxy instance 2,800 requests per second / 1,400 requests per second per proxy instance = 2 proxy instances

This sums up to 5 proxy instances. This amount is lower than the 10 proxy instances required to serve bandwidth. Thus, the proxy instance charge for this 10-minute time period would be calculated as follows:

10 proxy instances * $0.025 per proxy instance per hour * (10 minutes / (60 minutes per hour)) = $0.0417

Billing is calculated based on the measured capacity needed to satisfy your traffic needs, not the number of proxy instances that are establishing connections to your backends. As such, you might be billed for a different number of proxy instances than you see in your infrastructure.

Minimum proxy instance charge

To ensure optimal performance and reliability, each load balancer is allocated at least three proxy instances in the Google Cloud region where the load balancer is deployed. These proxy instances are allocated even if the load balancer handles no traffic. After a forwarding rule (with load balancing scheme INTERNAL_MANAGED) is deployed to your project, you start to accrue proxy instance charges. Additional forwarding rules incur additional proxy instance charges as described previously (in other words, three additional proxy instances per forwarding rule).

The three proxy instances that are allocated to your load balancer result in a minimum hourly proxy instance charge. For example, for the us-central1 Google Cloud region, the minimum charge is calculated as follows:

3 proxy instances * $0.025 per proxy per hour = $0.075 per hour

As described previously, these proxy instances can each handle a certain amount of traffic. Once your traffic needs surpass the capacity of these three proxy instances, you will incur costs for the proxy instances required to handle any additional traffic.

Data processing charge

The data processing charge is calculated by measuring the total volume of data for requests and responses processed by your load balancer during the billing cycle. This charge scales according to your usage and there is no minimum charge for data processing.

Cross-project service referencing with Shared VPC

For data processing, hourly proxy instance usage, and inter-zone VM egress, the forwarding rule project is charged.

Internal HTTP(S) load balancer pricing with serverless NEGs

If you are using serverless NEG backends for an internal HTTP(S) load balancer, existing internal HTTP(S) load balancer charges will apply in addition to the serverless compute charges for Cloud Run. Costs attributable to the internet egress will continue to apply.

Custom request headers and Google Cloud Armor charges

If a backend service has a Google Cloud Armor policy associated with it, you can use the custom request headers feature with that backend service without any additional charge for the custom request headers feature.

If a backend service that uses the custom request headers feature does not have a Google Cloud Armor policy associated with it, the charges are $0.75 per 1,000,000 HTTP(S) requests per month per account. You are only charged for the first 666,666,667 requests per month per account.

Global access for internal load balancers

Global access allows client instances from any region to access your internal load balancer. If a forwarding rule has global access enabled, additional cross-region egress traffic transit charges are incurred when traffic is sent to or from a client in a different region than the load balancer.

Global access is generally available for internal TCP/UDP load balancers, internal HTTP(S) load balancers, and internal regional TCP proxy load balancers.

Protocol forwarding

Protocol forwarding is charged at the same rate as load balancing. There is a charge for the forwarding rule and a charge for the inbound data processed by the target instance.

SSL certificates

There is no charge for self-managed and Google-managed SSL certificates.

Google Cloud Armor

This document explains Google Cloud Armor and Google Cloud Armor Managed Protection pricing details. This pricing is active.

	Standard Tier	Plus Tier
Billing model	Pay as you go	Subscription
Subscription price	N/A	$3,000/month (includes up to 100 protected resources)
Protected resources	N/A	$30/protected resource per month after initial 100
WAF requests WAF security policies WAF rules	$0.75 per million requests $5 per policy per month $1 per rule per month	All included
Data processing fee	None	Yes; see the following section.
Time commitment	None	One year
Google Cloud Armor bot management	Billed in accordance with the reCAPTCHA Enterprise pricing model	Billed in accordance with the reCAPTCHA Enterprise pricing model

Protected resources include the following backend types in each enrolled project; the backends are counted as protected resources for all covered endpoint and load balancer types in the enrolled project.

Endpoint type	Protected resource (backend type)
External HTTP(S) load balancer	Backend service Backend bucket
External SSL proxy load balancer	Backend service
External TCP proxy load balancer	Backend service
Network load balancer	Backend service (regional) Target pool
Protocol forwarding	Target instance
Public IP address (VM)	Instance

Data processing fee

The Managed Protection Plus data processing fee meters the data egressed to the internet from all protected resources for every project that is enrolled in Managed Protection Plus. The data processing fee is billed at the billing account level, aggregating usage across all protected resources in all projects enrolled in Managed Protection Plus.

Prices are per GiB egressed to the internet directly or through Carrier Peering, and are in addition to other network egress fees. For example, for workloads behind a supported Google Cloud load balancer, the data processing fee meters the bits egressed to the internet through the enrolled load balancer endpoints but does not meter the associated inter-region or inter-zone traffic by the underlying workload. The charge is $0.05 per GiB egressed for the first 100 TiB and $0.04 per GiB for the next 400 TiB. If the content being served is using Cloud CDN and is considered cacheable, then the data processing fee for Cloud CDN is applied for that content. The following table contains complete pricing.

TiB egressed	Cloud Load Balancing	Cloud CDN & Media CDN	Network load balancer/Instance	Cloud DNS
0-100	$0.05	$0.025	$0.05	Included
101-500	$0.04	$0.020	$0.04	Included
501-1000	$0.03	$0.015	$0.03	Included
1001+	Contact account team	$0.010	Contact account team	Included

Note: Rules utilizing reCAPTCHA Enterprise in the match condition or in the action are not treated any differently by Google Cloud Armor; usage billed still depends on your pricing model: Standard or Managed Protection Plus. However, reCAPTCHA Enterprise usage is subject to reCAPTCHA Enterprise billing.

If a backend service has a Google Cloud Armor security policy associated with it, you can use the custom headers feature with that backend service without any additional charge for the custom headers feature.

If you pay in a currency other than USD, the prices listed in your currency on Google Cloud Platform SKUs apply.

Cloud Intrusion Detection System

This document explains Cloud IDS pricing details. This pricing becomes active when Cloud IDS becomes generally available. For the duration of the preview, Cloud IDS is offered without usage fees.

Type of usage	Price
Per hour per endpoint	$1.50
Per GiB processed	$0.07

Cloud CDN

If you plan to serve a large volume of content from Cloud CDN (more than 500 TiB per month), you can contact us to discuss volume-based discounts.

This document discusses pricing for Cloud CDN.

Prices on this page are listed in US dollars (USD). If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Pricing structure

Case	What you pay for	Notes
Cacheable content, cache hit	cache lookup + cache egress	When Cloud CDN serves your content, you're charged for bandwidth and HTTP/HTTPS requests. The GET and HEAD HTTP methods cause cache lookups. Other methods such as POST and PUT do not. This also applies to Cloud CDN cache hits for cacheable content from custom origins.
Cacheable content, cache miss	cache lookup + cache egress + cache fill + applicable Cloud Load Balancing data processing or Cloud Storage operation charges	Cache fill and cache egress charges apply to cacheable content. On cache misses, any applicable Cloud Load Balancing data processing or Cloud Storage operation charges apply. These charges replace the network egress charges that apply when serving directly from Compute Engine or Cloud Storage. For Cloud CDN cache fills from external backends, requests to the external backend are charged at internet egress rates. Cache fills continue to benefit from Google's global backbone network between Google's Cloud CDN edge and origin.
Non-cacheable content	standard Compute Engine + Cloud Storage egress rates	For non-cacheable content, standard Compute Engine and Cloud Storage internet egress rates apply. For external backends, you're also charged for request bytes sent to external backends from the load balancer at the standard Compute Engine internet egress rates.

Overview

Cache egress and cache fill are calculated in gibibytes (GiB).

Item	Price
Cache egress	$0.02-$0.20 per GiB
Cache fill	$0.01-$0.04 per GiB
HTTP/HTTPS cache lookup requests	$0.0075 per 10,000 requests
Requests sent from Cloud CDN to external backends	Compute Engine internet egress rates

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Pricing calculator

You can use the Google Cloud Pricing Calculator to estimate the cost of using Cloud CDN.

Go to the pricing calculator

Cache egress

Cache egress charges represent cached responses served from Cloud CDN's caches, and vary based on the destination and your monthly usage. Monthly usage is calculated per project per destination. Destination is a geographic area determined by the client's IP address.

Destination		Price (per GiB) by monthly usage
				< 10 TiB	10 TiB-150 TiB	150 TiB-500 TiB	> 500 TiB
Asia Pacific (including Hong Kong)		$0.09	$0.06	$0.05	Contact Us
China^1		$0.20	$0.17	$0.16	Contact Us
Europe		$0.08	$0.055	$0.03	Contact Us
North America (including Hawaii)		$0.08	$0.055	$0.03	Contact Us
Oceania^2		$0.11	$0.09	$0.08	Contact Us
South America		$0.09	$0.06	$0.05	Contact Us
All other destinations (including Mexico, Central America, and Middle East)		$0.09	$0.06	$0.05	Contact Us

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

¹ Traffic destined for mainland China is served from Google locations outside of mainland China. Performance and reliability may be lower than for traffic served from in-country locations.

² Oceania includes Australia, New Zealand, and surrounding Pacific Ocean islands such as Papua New Guinea and Fiji. This region excludes Hawaii.

Cache fill

Monthly cache fill charges represent the data required to populate Cloud CDN's caches. For typical workloads where you are serving popular content, cache fill is often less than 10% of your total egress GiB. Charges vary based on the source and destination, where the source is the region of your backend service, or for external backends, the geographic area based on your origin's IP address.

Cache fill	Price (per GiB)
Within North America or Europe (including Hawaii)	$0.01
Within each of Asia Pacific, South America, Middle East, Africa, and Oceania (including Hong Kong)	$0.02
Inter-region cache fill (for example: between Asia Pacific and North America)	$0.04

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Pricing notes

• Network usage is calculated in gibibytes (GiB).
• Charges accrue daily, but Cloud CDN bills you only at the end of the billing period. You can view unbilled usage on your project's billing page in the Google Cloud console.
• The metered bytes for cache egress or cache fill include HTTP response headers (after compression, if applicable) and the response body, as well as any trailers.

Pricing example

The following example shows a simple scenario that might apply if you are just getting started with Cloud CDN.

Suppose you have the following Cloud CDN usage pattern in a given month.

Pricing category	Type of usage	Amount
Cache egress	Cache egress in North America	500 GiB
Cache fill	Data transfer to Cloud CDN caches	25 GiB
Cache lookup requests	GET and HEAD HTTP methods	5,000,000 operations

Your bill for the month is calculated as follows.

Pricing category	Calculation	Cost
Cache egress	500 GiB cache egress * $0.08 per GiB	$40.00
Cache fill	25 GiB fill * $0.01 per GiB	$0.25
Cache lookup requests	5,000,000 operations (500 GiB of 100 KiB responses, on average) $0.0075 per 10,000 operations $0.0075 * 500	$3.75
Total		~$44.00

Cloud Interconnect

This document explains Cloud Interconnect pricing details.

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Dedicated Interconnect

Google charges you on an hourly basis for both Interconnect connections and VLAN attachments. The hourly charge for each resource, either Interconnect connection or VLAN attachment, is charged to the project that owns the resource.

Egress traffic from your Virtual Private Cloud (VPC) networks through your Interconnect connections is discounted compared to general network pricing for Google Cloud. Egress pricing depends on the number of gibibytes (GiB) transferred and the location of your Interconnect connection.

This discounted pricing applies only to traffic that originates in the region where the VLAN attachment is located. You can use VLAN attachments to access services located in a different region than the VLAN attachment. In this case, you are charged standard cross-region rates for traffic between the region where the VLAN attachment is located and the region where the service is located.

Cloud Interconnect egress charges accrue to the project that owns the VLAN attachment. The project that owns the Interconnect connection is not billed for egress. Specifically, costs for egress traffic from a VLAN attachment in a Shared VPC service project, which travels through an Interconnect connection in a different host project, are attributed to the service project.

For HA VPN over Cloud Interconnect deployments, you are charged for your Dedicated Interconnect connections, VLAN attachments, HA VPN tunnels, and regional external IP addresses, if an IP address is assigned to a VPN gateway but not used by a tunnel.

In terms of HA VPN over Cloud Interconnect egress traffic, you are charged only for Cloud Interconnect egress traffic. You are not charged for Cloud VPN egress traffic.

For more information, see Cloud VPN pricing.

Pricing tables

Dedicated Interconnect pricing

Resource	Price
Interconnect connection	$2.328 per hour per 10-Gbps circuit
Interconnect connection	$18.05 per hour per 100-Gbps circuit
A 50-, 100-, 200-, 300-, 400-, or 500-Mbps VLAN attachment	$0.10 per hour per VLAN attachment
A 1-, 2-, 5-, or 10-Gbps VLAN attachment	$0.10 per hour per VLAN attachment
A 20-Gbps VLAN attachment	$0.20 per hour per VLAN attachment
A 50-Gbps VLAN attachment	$0.50 per hour per VLAN attachment

Egress traffic from a VPC network through an Interconnect connection

Interconnect connection location	Price
Asia	$0.042 per GiB
Europe	$0.02 per GiB
North America	$0.02 per GiB
South America	$0.08 per GiB
Australia	$0.042 per GiB

Ingress traffic through an Interconnect connection

Traffic type	Price
Ingress	Google does not charge for ingress traffic. However, there might be a charge for resources that process ingress traffic. For a list of these resources, see the VPC section of All networking pricing. Responses to requests count as egress traffic and are charged.

Pricing example

The following table shows an example usage pattern of Dedicated Interconnect connections for a single month.

Resources	Usage	Estimated cost
Interconnect connection	capacity 30 Gbps (3 x 10-Gbps circuit)	3 x 10-Gbps circuit x 24 hrs @ $2.328 per hour x 30 days = $5,028.48
Redundant Interconnect connection	capacity 30 Gbps (3 x 10-Gbps circuit)	3 x 10-Gbps circuit x 24 hrs @ $2.328 per hour x 30 days = $5,028.48
VLAN attachment	6 (one per Interconnect connection circuit)	6 x 10-Gbps attachment x 24 hrs @ $0.10 per hour x 30 days = $432.00
Egress traffic (leaving over an Interconnect connection in North America)	20 TiB	20,480 GiB x $0.02 = $409.60
Total cost		$10,898.56

Partner Interconnect

Google charges you on an hourly basis for VLAN attachments, depending on their capacity. The hourly charges are billed to the project that owns the VLAN attachment. Your service provider might also charge you for services such as using their network, which isn't included in your Google Cloud bills. For information about their pricing, contact your service provider.

Egress traffic from your VPC networks though your attachments is discounted compared to general network pricing for Google Cloud. Egress pricing depends on the number of gibibytes (GiB) transferred and the location of your Interconnect connection.

This discounted pricing applies only to traffic that originates in the region where the VLAN attachment is located. You can use VLAN attachments to access services located in a different region than the VLAN attachment. In this case, you are charged standard cross-region rates for traffic between the region where the VLAN attachment is located and the region where the service is located.

Cloud Interconnect egress charges accrue to the project that owns the VLAN attachment. The project that owns the Interconnect connection is not billed for egress. Specifically, costs for egress traffic from a VLAN attachment in a Shared VPC service project, which travels through an Interconnect connection in a different host project, are attributed to the service project.

For HA VPN over Cloud Interconnect deployments, you are charged for your VLAN attachments, HA VPN tunnels, and regional external IP addresses, if an address is assigned to a VPN gateway but not used by a tunnel.

In terms of HA VPN over Cloud Interconnect egress traffic, you are charged only for Cloud Interconnect egress traffic. You are not charged for Cloud VPN egress traffic.

For more information, see Cloud VPN pricing.

Pricing tables

Partner Interconnect pricing

Partner VLAN attachment capacity	Price
50 Mbps	$0.05417 per hour per VLAN attachment
100 Mbps	$0.0625 per hour per VLAN attachment
200 Mbps	$0.08333 per hour per VLAN attachment
300 Mbps	$0.1111 per hour per VLAN attachment
400 Mbps	$0.1389 per hour per VLAN attachment
500 Mbps	$0.1736 per hour per VLAN attachment
1 Gbps	$0.2778 per hour per VLAN attachment
2 Gbps	$0.5694 per hour per VLAN attachment
5 Gbps	$1.25 per hour per VLAN attachment
10 Gbps	$2.36 per hour per VLAN attachment
20 Gbps	$3.61 per hour per VLAN attachment
50 Gbps	$9.02 per hour per VLAN attachment

Egress traffic from a VPC network through an Interconnect connection

Interconnect connection location	Price
Asia	$0.042 per GiB
Europe	$0.02 per GiB
North America	$0.02 per GiB
South America	$0.08 per GiB
Australia	$0.042 per GiB

Ingress traffic through an Interconnect connection

Traffic type	Price
Ingress	Google does not charge for ingress traffic. However, there might be a charge for resources that process ingress traffic. For a list of these resources, see the VPC section of All networking pricing. Responses to requests count as egress traffic and are charged.

Pricing example

The following table shows an example usage pattern of Partner Interconnect connections for a single month.

Resources	Usage	Estimated cost
VLAN attachment	6 100-Mbps attachments	6 x $0.0625 x 720 hours = $270.00
Egress traffic (leaving over an Interconnect connection in North America)	20 TiB	20,480 GiB x $0.02 = $409.60
Total cost		$679.60

Cross-Cloud Interconnect

Google charges you on an hourly basis for both Cross-Cloud Interconnect connections and VLAN attachments. The hourly charge for each resource, either Cross-Cloud Interconnect connection or VLAN attachment, is charged to the project that owns the resource.

Egress traffic from your Virtual Private Cloud (VPC) networks through your Cross-Cloud Interconnect connections is discounted compared to general network pricing for Google Cloud. Egress pricing depends on the number of gibibytes (GiB) transferred and the location of your Cross-Cloud Interconnect connection.

This discounted pricing applies only to traffic that originates in the region where the VLAN attachment is located. You can use VLAN attachments to access services located in a different region than the VLAN attachment. In this case, you are charged standard cross-region rates for traffic between the region where the VLAN attachment is located and the region where the service is located.

Cross-Cloud Interconnect egress charges accrue to the project that owns the VLAN attachment. The project that owns the Interconnect connection is not billed for egress. Specifically, costs for egress traffic from a VLAN attachment in a Shared VPC service project, which travels through an Interconnect connection in a different host project, are attributed to the service project.

For HA VPN over Cloud Interconnect deployments, you are charged for your Cross-Cloud Interconnect connections, VLAN attachments, HA VPN tunnels, and regional external IP addresses, if an IP address is assigned to a VPN gateway but not used by a tunnel.

In terms of HA VPN over Cloud Interconnect egress traffic, you are charged only for Cloud Interconnect egress traffic. You are not charged for Cloud VPN egress traffic.

For more information, see Cloud VPN pricing.

Pricing tables

Cross-Cloud Interconnect pricing

Resource	Price
Cross-Cloud Interconnect connection	$5.60 per hour per 10-Gbps circuit
Cross-Cloud Interconnect	$30 per hour per 100-Gbps circuit
A 50-, 100-, 200-, 300-, 400-, or 500-Mbps VLAN attachment	$0.10 per hour per VLAN attachment
A 1-, 2-, 5-, or 10-Gbps VLAN attachment	$0.10 per hour per VLAN attachment
A 20-Gbps VLAN attachment	$0.20 per hour per VLAN attachment
A 50-Gbps VLAN attachment	$0.50 per hour per VLAN attachment

Egress traffic from a VPC network through an Interconnect connection

Interconnect connection location	Price
Asia	$0.042 per GiB
Europe	$0.02 per GiB
North America	$0.02 per GiB
South America	$0.08 per GiB
Australia	$0.042 per GiB

Ingress traffic through an Interconnect connection

Traffic type	Price
Ingress	Google does not charge for ingress traffic. However, there might be a charge for resources that process ingress traffic. For a list of these resources, see the VPC section of All networking pricing. Responses to requests count as egress traffic and are charged.

Pricing example

The following table shows an example usage pattern of Cross-Cloud Interconnect connections for a single month.

Resources	Usage	Estimated cost
Cross-Cloud Interconnect connection	capacity 10 Gbps (1 x 10-Gbps circuit)	1 x 10-Gbps circuit x 24 hrs @ $5.60 per hour x 30 days = $4,032
Redundant Cross-Cloud Interconnect connection	capacity 10 Gbps (1 x 10-Gbps circuit)	1 x 10-Gbps circuit x 24 hrs @ $5.60 per hour x 30 days = $4,032
VLAN attachment	2 (one per Interconnect connection circuit)	2 x 10-Gbps attachment x 24 hrs @ $0.10 per hour x 30 days = $144.00
Egress traffic (leaving over an Interconnect connection in North America)	200 TiB	204,800 GiB x $0.02 = $4,096.00
Total cost		$12,304

Pricing scenarios

This section describes different pricing scenarios for how Google Cloud calculates pricing for Cloud Interconnect egress traffic; that is, when a virtual machine (VM) instance or a non-VM Google Cloud product or service sends traffic to your on-premises location over a VLAN attachment located in the same or different geographical location:

• A VM in the same region as a VLAN attachment, using either regional or global VPC dynamic routing
• A VM in the same continent but different region than a VLAN attachment, using global VPC dynamic routing
• A VM in a different continent than a VLAN attachment, using global VPC dynamic routing
• A VM in a different continent than a VLAN attachment, using VPC Network Peering
• A non-VM Google Cloud product or service in a different location than a VLAN attachment, using global VPC dynamic routing

Note: You have to pay standard inter-region charges for traffic between the region of the VM and the region of the VLAN attachment, which is more if they are in different continents. This applies to non-VM traffic as well.

For more information about costs for each scenario, including egress charges between regions within a continent and between continents, see General network pricing.

A VM in the same region as a VLAN attachment, using either regional or global VPC dynamic routing

Note: The dynamic routing mode that you use does not impact the pricing.

In this scenario, there are two regions within North America, us-west1 and us-east1. These regions use VPC regional dynamic routing provided by Cloud Router. In this scenario, it doesn't matter which dynamic routing mode you use.

VM in same continent, regional routing (click to enlarge)
Cloud Interconnect egress charges for North America
No region-to-region egress charges

You order an Interconnect connection running from your on-premises location to San Jose (SJC) and create two VLAN attachments over that connection. One VLAN attachment goes to region us-east1, and the other VLAN attachment goes to region us-west1.

If you send traffic from a VM in us-east1 or from a VM in us-west1 to your on-premises location over your Interconnect connection in SJC, you are charged the following rates:

• Cloud Interconnect egress charges for North America (because that is where the Interconnect connection is located).
• You are not charged region-to-region egress charges because the VMs are using a VLAN attachment in the same region.

Note: Unless you enable global dynamic routing for your VPC network by using Cloud Router, your regions without a VLAN attachment have no access to your Interconnect connection. This also means that you can't accidentally incur intercontinental egress charges if you have regions located on different continents.

A VM in the same continent but different region than a VLAN attachment, using global VPC dynamic routing

In this scenario, you have VMs in two regions located in North America, us-west1 and us-east1. You have enabled global dynamic routing for your VPC network by using Cloud Router. Global dynamic routing enables VLAN attachments in one region to be used by one or more VMs located in another region.

VM in same continent, global dynamic routing (click to enlarge)
Region-to-region egress charges from us-east1 to us-west1
Cloud Interconnect egress charges for North America from us-west1 to on-premises

You order an Interconnect connection running from your on-premises location to San Jose (SJC) and create one VLAN attachment over that connection to us-west1. You then send traffic from a VM in us-east1 to your on-premises location through the VLAN attachment located in us-west1. You are then charged the following rates:

• Region-to-region egress charges for forwarding traffic from us-east1 to the VLAN attachment in us-west1. The VLAN attachment in us-west1 is considered the source of traffic.
• Cloud Interconnect egress charges for North America for traffic from region us-west1 to your on-premises location.

A VM in a different continent than a VLAN attachment, using global VPC dynamic routing

This scenario is the same as the preceding example, except that one region, us-west1, is located in North America, and the other region, asia-east1, is located in Asia. Sending traffic between regions on different continents results in more expensive inter-region egress rates.

VM in a different continent, global dynamic routing (click to enlarge)
Intercontinental region-to-region egress charges for traffic forwarded from asia-east1 to us-west1
Cloud Interconnect egress charges for North America from us-west1 to on-premises

The only way to send traffic from asia-east1 over Cloud Interconnect in North America is by enabling VPC global dynamic routing. This makes the VLAN attachment in us-west1 available to VMs in all regions in your VPC network. You are then charged the following rates:

• Intercontinental region-to-region egress charges for traffic forwarded from asia-east1 to us-west1.
• Cloud Interconnect egress charges for North America for traffic from region us-west1 to your on-premises location.

A VM in a different continent than a VLAN attachment, using VPC Network Peering

This scenario is similar to the preceding example, except that there are two VPC networks connected through VPC Network Peering. Sending traffic between regions results in the same rates as the preceding example that uses global dynamic routing.

VM in a different continent, VPC Network Peering (click to enlarge)
Intercontinental region-to-region egress charges for traffic forwarded from us-east4 to asia-northeast1
Cloud Interconnect egress charges for Asia from asia-northeast1 to on-premises

You send traffic from us-east4 to your on-premises network over Cloud Interconnect in Asia by using VPC Network Peering. You are then charged the following rates:

• Intercontinental region-to-region egress charges for traffic forwarded from us-east4 to asia-northeast1.
• Cloud Interconnect egress charges for Asia for traffic from region asia-northeast1 to your on-premises location.

A non-VM Google Cloud product or service in a different location than a VLAN attachment, using global VPC dynamic routing

In addition to the preceding scenarios, Cloud Interconnect egress charges apply to traffic sent from a Google Cloud product or service that is not a VM to your on-premises location over a VLAN attachment. You pay the product's egress charges to reach the region of the VLAN attachment, and then pay the Cloud Interconnect egress charges based on the continent where the Interconnect connection is located.

Note: For information about egress charges for other Google Cloud products not described in this example, see the pricing page for that product.

The following example describes charges for traffic egressing a Cloud Storage bucket in a different region in North America than the region where the VLAN attachment is located.

Non-VM in two North American regions, global dynamic routing (click to enlarge)
Cloud Storage egress charges for traffic forwarded from a Cloud Storage bucket in northamerica-northeast1 to us-west1
Cloud Interconnect egress charges for North America from us-west1 to on-premises

In this scenario, you have resources in two regions located in North America, us-west1 (Oregon) and northamerica-northeast1 (Montreal). You have enabled global dynamic routing for your VPC network by using Cloud Router.

You order an Interconnect connection running from your on-premises location to San Jose (SJC) and create one VLAN attachment over that connection to us-west1. You then send traffic from a Cloud Storage bucket in northamerica-northeast1 to your on-premises location through the VLAN attachment located in us-west1. You are charged the following rates:

• The Cloud Storage egress cost for forwarding traffic from a Cloud Storage bucket in northamerica-northeast1 to a VLAN attachment in us-west1. If the regions were both inside the US location, then there would be no egress charge.
• Cloud Interconnect egress charges for North America for traffic from region us-west1 to your on-premises location (because that is where your Interconnect connection is located).

If the Cloud Storage bucket is located in a different continent than the VLAN attachment, you pay Cloud Storage intercontinental egress charges to reach the VLAN attachment in us-west1.

For a full list of pricing scenarios for Cloud Storage, see the Cloud Storage pricing page.

Cloud Router

Cloud Router is provided free of charge. General networking costs apply to control plane (BGP) traffic. In most cases, these costs are negligible.

For more information about networking costs, see General network pricing in the Virtual Private Cloud (VPC) documentation.

Cloud VPN

At a high level, your Cloud VPN charges consist of the following:

• An hourly charge for each Cloud VPN gateway; this charge is determined partly by the number of tunnels attached to the gateway, as well as the location of the gateway
• A monthly charge for IPsec traffic
• An hourly charge for any external IP address assigned to a VPN gateway but not used by a tunnel

For more information about Cloud VPN, see the Cloud VPN overview.

Note: Only VPN tunnels in certain tunnel states are billed.

Pricing table

To view pricing, select the location of the Cloud VPN gateway. Except where otherwise noted, all details apply to both Classic VPN and HA VPN.

Google does not charge for forwarding rules that send traffic to the VPN gateway.

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Pricing scenarios

For help understanding Cloud VPN pricing, refer to the following examples.

us-central1 gateway to data center

Suppose you have a VPN gateway in us-central1. That gateway uses two tunnels to connect with an on-premises data center in Iowa.

Each month, you send 2 tebibytes (TiB) of data through the tunnel, from your Virtual Private Cloud (VPC) network to your data center. At the same time, you send 2 TiB in the other direction—from the data center to your VPC network.

Additionally, your gateway uses a reserved external IP address.

The following table shows the charges that you'd incur during a 30-day month with this setup.

Gateway	Egress traffic	Ingress traffic	IP address	Total
us-central1 gateway ($0.050) x 2 tunnels x 720 hours = $72.00	2 TiB (or 2,048 GiB) x $0.11 = $225.28	No charge for ingress traffic.	No charge for a reserved external IP address that is used by a tunnel.	$297.28

asia-northeast1 gateway to data center and another VPC network

Suppose your project has a VPC network called Network A, which includes a VPN gateway in asia-northeast1. This gateway uses two tunnels to connect with an on-premises data center in Tokyo. Additionally, this gateway uses two tunnels to connect with Network B, another VPC network in your project. Network B's gateway is located in europe-west6.

Each month, your data usage is as follows:

• Users in Network A download 10 TiB of data from Cloud Storage and send it to the Tokyo data center.
• Networks A and B send each other about 20 TiB of data.

Both the asia-northeast1 and europe-west6 gateways use reserved external IP addresses.

Additionally, you have a third VPN gateway in southamerica-east1. You created this gateway several months ago and assigned it a reserved external IP address. However, you never set up a tunnel for this gateway.

The following table shows the charges that this setup would incur during a 30-day month.

Gateway	Egress traffic	Ingress traffic	IP address	Total
asia-northeast1 gateway ($0.075), with four tunnels x 720 hours = $216.00	Traffic to the data center: 10 TiB (or 10,240 GiB) x $0.14 = $1,433.60	No charge for ingress traffic.	No charge for a reserved external IP address that is used by a tunnel.	$3,288.00
	Traffic to Network B: 20 TiB (or 20,480 GiB) x $0.08 = $1,638.40	No charge for ingress traffic.
europe-west6 gateway ($0.065) x 2 tunnels x 720 hours = $93.60	Traffic to Network A: 20 TiB (or 20,480 GiB) x $0.08 = $1,638.40	No charge for ingress traffic.	No charge for a reserved external IP address that is used by a tunnel.	$1,732.00
southamerica-east1 gateway ($0.075) x 0 tunnels x 720 hours = no charge	No egress traffic.	No ingress traffic.	One unused external IP address in southamerica-east1 ($0.015) x 720 hours = $10.80.	$10.80
Grand total				$5,030.80

Network Connectivity Center

This document describes pricing for Network Connectivity Center.

Network Connectivity Center is a hub-and-spoke model for network connectivity management in Google Cloud. With this model, on-premises networks connect to a Network Connectivity Center hub by using spokes that have supported Google Cloud spoke resources attached to them.

For more information about Network Connectivity Center, see the Network Connectivity Center overview.

Current pricing

The following sections describe the current pricing for Network Connectivity Center.

Hubs and spokes

The following table describes charges for hubs and spokes. Spoke hours refers to the number of hours within a month that a spoke is active.

Spoke hour charges are waived for up to three VPN spokes and three Interconnect spokes.

Note: Interconnect spokes are sometimes referred to as VLAN attachment spokes.

Resource	Price per month
Hub	No charge
Spoke hours	$0.075 per hour

Data transfer

Data transfer refers to region-to-region traffic that uses Google's network to connect non-Google Cloud networks.

Data-transfer traffic is different from ingress and egress traffic, which flows either into or out of Google's network. In contrast, data-transfer does both: it flows into and out of Google's network, because it originates and terminates outside of Google's network.

Data transfer charges are based on gibibytes (GiB) of traffic per month.

Post-GA pricing

In addition to the pricing described in Current pricing, future Network Connectivity Center releases will include an Advanced Data Networking charge.

Advanced Data Networking

Advanced Data Networking (ADN) refers to the processing fee charged for all traffic that is sent from a spoke through a hub.

The ADN charge is $0.02 per gibibyte (GiB) per month.

This fee is currently waived.

Pricing example

In this example, an enterprise connects two Router appliance spokes to their Network Connectivity Center hub. One spoke represents an office in Los Angeles (us-west2). Another represents an office in Mumbai (asia-south1).

Every month, the US office transfers 5 TiB of data to the Asia office, and the Asia office transfers 5 TiB to the US office.

The following table describes how this customer would be charged for one 30-day month.

Resources	Usage	Formula	Estimated monthly cost
Spoke hour charges	2 spokes	2 x 24 hours x 30 days at $0.075	$108.00
Data transfer charges	5 TiB of data transferred (Los Angeles -> Mumbai) 5 TiB of data transferred (Mumbai -> Los Angeles) Total: 10 TiB between one unique site pair.	5 TiB (5 * 1,024 GiB = 5,120 GiB) at $0.11 per GiB 5 TiB (5 * 1,024 GiB = 5,120 GiB) at $0.11 per GiB	$563.20 $563.20
Advanced Data Networking	10 TiB of data	10 TiB (1 * 1,024 GiB = 10,240 GiB) at $0.02 per GiB	$204.80 Currently waived
Total cost			$1,234.40

Pricing for other Google Cloud resources

The pricing on this page does not include charges for other Google Cloud resources and products that you might be using in conjunction with Network Connectivity Center. For example:

• If you use Router appliance spokes, you pay for the underlying Compute Engine resources.
• If you use VLAN attachment spokes, you pay for the underlying Cloud Interconnect resources.
• If you use VPN spokes, you pay for the underlying Cloud VPN resources.

Router appliance

Pricing for Router appliance is part of Network Connectivity Center pricing. For pricing, see Network Connectivity Center pricing.

For more information about networking costs, see General network pricing in the Virtual Private Cloud documentation.

Cloud NAT

Cloud NAT pricing is based on the following usage:

• An hourly price for the NAT gateway that is based on the number of VM instances that are using the gateway. The per-hour rate is capped at 32 VM instances. Gateways that are serving instances beyond the maximum number are charged at the maximum per-hour rate.

  Google Cloud counts VM instances that get a NAT assignment as using the gateway. The NAT gateway performs source NAT (SNAT) for egress traffic from resources that don't have external IP addresses, and destination NAT (DNAT) for ingress packets that arrive as responses to outbound packets.

• A per-GiB cost for ingress and egress data that is processed by the gateway. The data processing price is the same across all regions. Egress costs to send traffic from the VM out of the network also apply.

Number of assigned VM instances	Price per hour	Price per GiB processed, both egress and ingress
Up to 32 VM instances	$0.0014 * the number of VM instances that are using the gateway	$0.045
More than 32 VM instances	$0.044	$0.045

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

The total cost for running a NAT gateway and running traffic through it is as follows:

total cost for running the gateway = hourly cost for the NAT gateway
+ cost per GiB of data that is processed by the gateway
+ egress costs for any traffic leaving the network

Pricing example

The following table shows the estimated monthly cost for a single NAT gateway that is serving a different number of VM instances. For both cases, the gateway runs for 720 hours in a billing cycle.

Usage	Estimated bill
14 VM instances Gateway processes 100 GiB of traffic (egress and ingress)	($0.0014 * 14 instances * 720 hours) + (100 GiB processed traffic * $0.045) = $18.61
36 VM instances Gateway processes 200 GiB of traffic (egress and ingress)	($0.044 * 720 hours) + (200 GiB processed traffic * $0.045) = $40.68

Logging pricing

NAT logging pricing is described in Network Telemetry pricing.

Standard pricing for Cloud Logging, BigQuery, or Pub/Sub apply.

Cloud DNS

With Cloud DNS pricing, the charge is per zone per month (regardless of whether you use your zone), and you also pay for queries against your zones.

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Note: There is no free tier for Cloud DNS.

Pricing table

The following pricing applies to all zone types: public, private, and forwarding. All zone types are aggregated for purposes of pricing. For example, if you have 10 public zones, 10 private zones, and 10 forwarding zones, then your pricing is based on having 30 zones. All queries are aggregated as well, regardless of zone type.

You can use labels to label zones in certain ways. You can then use these labels to see per-label breakdowns in your billing.

Query pricing

Number of queries	Regular queries	Routing policy queries
0-1 billion	$0.40 per million queries per month	$0.70 per million queries per month
Over 1 billion	$0.20 per million queries per month	$0.35 per million queries per month

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Managed zone pricing

Managed zones^*	Price
0-25	$0.20 per managed zone per month
26-10,000	$0.10 per managed zone per month for each additional zone after 25
Over 10,000	$0.03 per managed zone per month for each additional zone over 10,000

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

^* Managed zone pricing is calculated based on the number of managed zones that exist at a time, prorated by the percentage of the month they exist. This prorating is measured by hour. Zones that exist for a fraction of an hour are counted as having existed for the whole hour.

Cloud DNS usage does not result in any egress charges.

Pricing for health checks

Health check type	Capabilities	Price
Internal fast health checks	Default 5s probes (configurable) SSL, TCP, and HTTP protocols	$0.50 per health check per month
Internal premium health checks	Default 5s probes (configurable) SSL, TCP, HTTP, HTTPS, HTTP/2, and gRPC protocols Content-based health checks (all protocols except gRPC)	$2.00 per health check per month

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Pricing example

The following table shows sample Cloud DNS usage patterns and the potential costs per month:

Usages	Standard website	Enterprise	Web virtual hosting provider
Zones	5	200	100,000
Zone cost	5 * $0.20 = $1.00	25 * $0.20 = $5.00 175 * $0.10 = $17.50	25 * $0.20 = $5.00 9,975 * $0.10 = $997.50 90,000 * $0.03 = $2,700.00
Monthly queries	10,000,000	50,000,000	100,000,000
Queries cost	10 * $0.40 = $4.00	50 * $0.40 = $20.00	100 * $0.40 = $40.00
Total cost	$5.00/month	$42.50/month	$3,742.50/month

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Pricing for queries is proportional to usage. So 500,000 queries would be charged $0.20 (half the price of 1 million queries).

Note: If you are a high volume user managing millions of DNS zones and/or record sets, contact us to tell us what you need.

Post GA pricing example for health checks

Resources	Usage	Formula	Estimated cost per month
Internal fast health check	Single service deployed using 3 Layer 4 internal load balancers, situated in us-east, us-central, and us-west	3 * 30 days @ $0.50 per month	$1.5
Internal premium health check	Single service deployed using 3 Layer 7 internal load balancers, situated in us-east, us-central, and us-west	3 * 30 days @ $2.0 per month	$6.0

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Service Directory

Component billed	Price (USD)
Service Directory namespace, service, or endpoint registered by using the API	$0.10 per namespace, service, or endpoint per month
Service Directory namespace, service, or endpoint registered by using automatic integration, such as an internal load balancer, Private Service Connect, or Google Kubernetes Engine	$0.00 per namespace, service, or endpoint per month
Service Directory API calls	$1.00 per million Service Directory API calls per month

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Note that if you use Service Directory zones, you are billed separately for Cloud DNS based on Cloud DNS pricing.

Cloud Domains

Pricing overview

Domains are registered in increments of one year. By registering a domain, you're committing to paying for the whole year. Domains are renewed automatically. If your domain renews in Cloud Domains, you are billed for the 12 months following your renewal date. If you want to stop paying for your domain, or if don't want your domain to automatically renew, you can export or delete the domain.

Note: If you use Cloud DNS, you are billed separately for the DNS cost. For detailed information on Cloud DNS pricing, see the Cloud DNS pricing page.

Pricing per domain ending

Prices vary based on domain endings (TLDs) listed in the pricing table. For example, if you buy example.com, example.charity, and example.wiki, the yearly cost of each of these domains differ because the domain endings .com, .charity, and .wiki have different costs. The yearly price of each domain that you register is added to get the total cost. See the Pricing example.

For detailed information about domain endings, click the domain ending on the Google Domains supported domain endings page.

Cloud Domains does not support the following kinds of domains:

• Premium domains
• Domains that require a trademark notice

Billing models

The billing model for Cloud Domains varies by when you registered your domain. If your Cloud Billing address is in Brazil, for details on Brazil pricing, see the Commitment billing section.

Subscription billing (for Cloud Billing accounts outside Brazil)

The Subscription billing model bills you the yearly amount for the domain in the first month following a domain registration, renewal, or transfer. This applies to all domains that are registered, renewed, or transferred at Cloud Domains general availability.

Charges from Cloud Domains show up on your invoice under Charges not specific to a project because the charges are tied to the Cloud Billing account.

The Subscription billing model is not included in the Enterprise Discount Program.

Monthly billing

If you registered your domain during the public preview of the product, you are billed with the Monthly method.

Payments are collected on a monthly basis. You are billed 1/12 of the total cost every month for 12 months following a domain registration, renewal, or transfer. If you export or delete your domain any time during the 12-month period, you are still billed for the full year's payment.

Commitment billing (for Cloud Billing accounts in Brazil)

If your Cloud Billing account has a Brazil address, the Commitment billing model bills you 1/12 of the total cost every month for the next 12 months until the domain expires. This applies to all domains that are registered, renewed, or transferred at Cloud Domains general availability.

Charges from Cloud Domains show up on your invoice under Charges not specific to a project because the charges are tied to the billing account.

The Subscription billing model is not included in the Enterprise Discount Program.

If you choose to export or delete your registration during the 12-month period from your registration, renewal, or transfer date, you are charged a cancellation fee. The cancellation fee is equal to the unbilled portion of the annual cost of the domain.

Billing for newly-registered domains

When you register a domain using Cloud Domains, you are committing to paying for a full year of registration. All domains registered before GA use monthly billing until they expire or auto-renew. Any domains registered after the product is GA use subscription or commitment billing.

Domains that you registered before GA follow the Monthly billing model. However, starting January 10, 2022, whenever your domain renews, you will be switched to the Subscription model.

Billing for transferred-in domains

When you transfer in a domain from another provider, billing is as follows.

• Your existing registration time with your original provider is maintained.
• On completion of the transfer, the registration time is extended by a year.
• You are billed for the extended year right away.
• You are not billed again until your domain is about to expire and needs to be renewed.

Any domains transferred-in use subscription or commitment billing.

Example

The following examples explain how billing works for transferred-in domains.

• If the domain had one month of registration time left before transfer, you get billed for 1 year at time of transfer. The next billing event after the transfer completes is the domain's next renewal, 13 months (1 month + 1 year) after the transfer.
• If the domain had two years of registration time left before transfer, the next billing event is 3 years (2 years + 1 year) later.

Billing for renewals

If your domains are renewed before Jan 10, 2022, your payments are collected on a monthly basis. You are billed 1/12th of the total cost every month for 12 months. Any domains renewed after Jan 10, 2022 use subscription or commitment billing.

To stop auto-renewal or to manage a domain's billing account individually (outside a Google Cloud project), you must export the domain to Google Domains or transfer it out to a third-party registrar. However, once you register a domain with Cloud Domains, if you choose to export it to Google Domains or a third-party before the 12-month period expires, you are still charged for the domain for the remainder of the 12 months. The billing frequency depends on the billing model for your resource.

You must use Cloud Domains billing to manage the billing of domains registered with Cloud Domains. You cannot use Google Domains instead.

Free usage

Cloud Domains does not offer free usage for domain registration. For information on quotas, see the Quotas page.

Pricing table

Domain ending or TLD	Yearly price per unit (USD)
.academy	30
.accountant	30
.actor	40
.agency	20
.airforce	30
.apartments	60
.app	14
.army	30
.art	14
.associates	30
.attorney	40
.auction	30
.autos	15
.band	20
.bargains	30
.best	20
.bid	30
.bike	30
.bingo	50
.biz	15
.black	60
.blog	30
.blue	20
.boats	15
.boutique	30
.builders	30
.business	12
.buzz	40
.cab	30
.cafe	40
.camera	40
.camp	40
.capital	50
.cards	30
.care	30
.careers	50
.cash	30
.catering	30
.cc	20
.center	20
.charity	30
.chat	40
.cheap	30
.church	40
.city	20
.claims	60
.cleaning	40
.clinic	50
.clothing	30
.cloud	20
.club	13
.co	30
.co.in	11
.co.nz	19
.co.uk	12
.coach	60
.codes	50
.coffee	30
.com	12
.com.mx	20
.community	30
.company	14
.computer	30
.contact	12
.condos	50
.construction	30
.consulting	30
.contractors	30
.cool	30
.coupons	60
.cricket	30
.cruises	50
.dance	20
.date	30
.dating	50
.day	12
.de	7
.deals	40
.degree	40
.delivery	60
.democrat	30
.dental	50
.dentist	40
.design	40
.dev	12
.diamonds	50
.digital	40
.direct	40
.directory	20
.discount	30
.dog	40
.domains	30
.download	30
.earth	20
.education	20
.email	20
.engineer	30
.engineering	50
.enterprises	30
.equipment	20
.estate	30
.events	30
.exchange	30
.expert	50
.exposed	20
.express	30
.fail	30
.faith	30
.family	20
.fan	40
.fans	12
.farm	30
.finance	60
.financial	50
.fish	30
.fitness	30
.flights	50
.florist	30
.football	30
.forsale	30
.foundation	30
.fr	10
.fun	20
.fund	50
.furniture	50
.futbol	13
.fyi	20
.gallery	20
.games	20
.gifts	40
.gives	30
.glass	40
.gmbh	30
.golf	60
.graphics	20
.gratis	20
.gripe	30
.group	20
.guide	40
.guru	28
.haus	28
.healthcare	60
.hockey	60
.holdings	50
.holiday	50
.homes	15
.hospital	50
.house	30
.how	30
.icu	12
.immo	40
.immobilien	30
.in	12
.industries	30
.info	12
.ink	28
.institute	20
.insure	60
.international	20
.io	60
.irish	14
.jetzt	20
.jewelry	60
.jp	40
.kaufen	30
.kitchen	40
.land	30
.lawyer	40
.lease	50
.legal	60
.life	40
.lighting	20
.limited	30
.limo	50
.live	20
.llc	30
.loan	30
.love	30
.ltd	20
.luxury	40
.maison	50
.management	20
.market	40
.marketing	30
.mba	40
.me	20
.media	30
.memorial	60
.men	30
.mobi	20
.moda	30
.money	40
.mortgage	40
.mx	40
.navy	30
.net	12
.network	20
.news	30
.ninja	19
.nl	8
.one	12
.online	30
.ooo	30
.org	12
.page	10
.partners	50
.parts	30
.party	30
.photography	20
.photos	20
.pictures	11
.pizza	60
.place	15
.plumbing	40
.plus	40
.press	60
.pro	20
.productions	30
.promo	20
.properties	30
.pub	30
.pw	9
.racing	30
.recipes	50
.red	20
.rehab	30
.reisen	20
.rentals	30
.repair	30
.report	20
.republican	30
.rest	40
.restaurant	60
.review	30
.reviews	20
.rip	20
.rocks	13
.run	20
.sale	30
.salon	50
.sarl	40
.school	40
.schule	20
.science	30
.services	30
.shoes	40
.shopping	30
.show	40
.singles	30
.site	20
.ski	50
.soccer	20
.social	30
.software	40
.solar	40
.solutions	20
.soy	20
.space	20
.store	50
.stream	30
.studio	20
.style	40
.supplies	20
.supply	20
.support	20
.surgery	50
.systems	20
.tax	50
.taxi	60
.team	40
.tech	40
.technology	20
.tennis	60
.theater	60
.tienda	50
.tips	20
.today	20
.tools	30
.tours	60
.town	30
.toys	40
.trade	30
.training	30
.tube	30
.uk	12
.university	50
.uno	20
.vacations	30
.vegas	60
.ventures	50
.vet	30
.viajes	50
.video	20
.villas	50
.vin	60
.vision	30
.voyage	50
.watch	30
.webcam	30
.website	20
.wiki	28
.win	30
.wine	60
.works	30
.world	40
.wtf	30
.xyz	12
.zone	30

If you pay in a currency other than USD, the prices listed in your currency on Cloud Platform SKUs apply.

Billing SKUs

To search for appropriate SKUs for the billing model applicable to your registration, transfer, or renewal, use the following links.

• All Cloud Domains SKUs.
• Subscription billing SKUs.
• Monthly billing SKUs.
• Commitment billing SKUs.
• Cancellation SKUs.

Pricing example

The following examples use US pricing.

Example 1

Subscription billing: You buy a $12 .com domain. On your next monthly bill you are charged $12. Your next charge is one year later when the domain renews for $12.

Commitment billing: You buy a $12 .com domain. On your next monthly bill you are charged $1, and you are charged $1 for each monthly billing cycle until the domain expires. If you decide to delete the domain after being billed for 5 months ($5 total), you are billed a $7 cancellation fee to bring the billed total to $12.

Monthly billing: You buy a $12 .com domain. On your next monthly bill you are charged $1, and you are charged $1 for each monthly billing cycle until the domain expires. You cannot delete the domain before expiration, ensuring that the billed total will be $12.

Example 2

Suppose that you have registered three domains: example.charity, example.wiki, and example.info.

The cost is:

.charity = $30/year

.wiki = $28/year

.info = $12/year

Subscription cost = $30 + $28 + $12 = $70/year

Monthly or Commitment billing = 1/12th of the yearly price = $70/12 = $5.83/month

What's next

• Read the Virtual Private Cloud documentation.
• Try the Pricing calculator.
• Learn about VPC solutions and use cases.

Request a custom quote

With Google Cloud's pay-as-you-go pricing, you only pay for the services you use. Connect with our sales team to get a custom quote for your organization.

Contact sales