Exercise 2: Why Hybrid Cost Investigations Should Always Check Egress — Possible Solution ==================================================================== Why this needs checking even when compute/storage/tagging look completely normal: Per this chapter and `cloud1-9`, data moving BETWEEN environments -- cloud-to-cloud across two providers, or between on-prem and cloud -- incurs EGRESS CHARGES ON THE SENDING SIDE, and this is described as "a genuinely common real finding when investigating a cost anomaly... in a hybrid or multi-cloud environment specifically." Critically, this cost category is structurally SEPARATE from compute usage, storage usage, and resource tagging -- it's generated purely by data crossing an environment boundary, independent of whether any individual resource looks oversized, orphaned, or unusual on its own. This means a cost increase can be ENTIRELY attributable to increased cross-environment data transfer -- for example, a backup or replication process sending more data between on-prem and cloud than intended, or a workflow that used to stay within one environment now routinely crossing the boundary -- while every individual compute instance is correctly sized, every storage volume is properly attached and tagged, and nothing about `cloud2-7`'s usual-suspect checklist turns up anything unusual at all. Standard cost-anomaly investigation techniques focused on individual resources would find nothing wrong, because the actual driver of the cost increase isn't any single resource -- it's the VOLUME AND DIRECTION of data crossing the environment boundary itself. Skipping this check specifically in a hybrid/multi-cloud context risks missing the actual cause entirely, since it's a cost category that simply doesn't exist in a single-provider environment the same way, and therefore isn't automatically covered by habits built around `cloud1-9`'s original, single-environment usual-suspects list. WHY THIS WORKS AS AN ANSWER ------------------------------ This explains specifically WHY egress cost is structurally independent from the resource-level checks (compute/storage/tagging) that a standard cost investigation would otherwise rely on -- it's generated by cross-boundary data movement itself, not any individual resource's configuration, which is exactly why it needs its own explicit check rather than being assumed to be caught by the standard checklist.