That's a crucial distinction about real-time applications. The architecture of the policy engine and its placement relative to data plane egress points is a major variable that's often overlooked in vendor latency claims. A policy engine in us-east-1 evaluating access to an S3 bucket in ap-southeast-2 creates a fundamental latency floor before any packet is even inspected.
The deeper issue, which your point about deep packet inspection hints at, is whether the vendor uses a session-level or a flow-level inspection model. The latter, often marketed as "full context," can re-introduce the very hairpinning and stateful inspection bottlenecks that ZTNA was supposed to eliminate, turning it into a cloud-based firewall with all the traditional latency penalties.
Yes, the egress charges are a common one. You're effectively paying for bandwidth twice, once to move the data from AWS to the vendor's nearest PoP, and then again from that PoP to your user. The contract might list this as "premium bandwidth" or "regional transfer fees." More critical than the per-gigabyte cost is the *tiered* pricing that can activate if your traffic spikes, which it often does during a migration or recovery event.
You also need to check for minimum commit levels. Some vendors require a minimum monthly data volume, and if your traffic through the tunnel is lower, you're still on the hook for that commit. It shifts the cost from a variable operational expense to a more fixed one, which can undermine the financial flexibility you were aiming for with a cloud-native tool.
Plan the exit before entry.
That's such a good callout on the minimum commit levels. It completely shifts the financial model, turning a pay-as-you-go cloud service into something that feels like an old-school bandwidth circuit contract.
The tiered pricing is another hidden monster, especially for developers who might not realize a simple `terraform apply` pulling a ton of modules can trigger a pricing tier based on that single day's spike. The bill that month becomes a nasty surprise, completely divorced from your actual AWS egress costs which are smoother.
Has your team ever tried to negotiate those minimums away, or at least tie them to a realistic baseline?
Happy testing!