Cloud CDN pricing is cache egress per GiB by the destination of the user, in tiers per month, plus cache fill per GiB when the cache fetches from the origin, cache lookup requests per 10,000, and the load balancer in front of it, which the CDN cannot run without; Media CDN prices the same shape for streaming. Cloud Armor charges per security policy and rule per month and per million requests evaluated under its Standard tier, or a subscription per month with a data processing fee per GiB under Cloud Armor Enterprise, which adds adaptive protection, threat intelligence and DDoS response. On the bill, cache egress dominates on anything that serves media, cache fill on origins that change often, and the Armor line is set by the request count, because every request through a protected load balancer is evaluated.

Pricing dimensions

Google prices the CDN by the bytes it serves and the Armor by the requests it inspects; every destination, tier and policy has its own SKU, and neither depends on the region of the origin but on where the users are.

DimensionUnitWhat drives itOptional
Cache egressGiB served from cache per destination continent in four monthly tiers, North America and Europe cheapest, China dearest; the Premium tier rates, lower than the load balancer's own egressEvery cache hit's bytes to the userNo
Cache fillGiB fetched from the origin into the cache, within a region cheapest, across regions and continents moreCache misses, short TTLs, many regions, origins far from usersNo
Cache lookup requestsPer 10,000 HTTP or HTTPS requests that look up the cache, hit or missEvery request through the CDNNo
Load balancer and originThe Application Load Balancer's forwarding rules and data processing per GiB, Cloud Storage operations and egress on missesThe CDN's prerequisite and its originNo
Media CDNGiB of egress by destination with its own tiers, cache fill and requests, for video and large filesStreaming workloadsYes
Cloud Armor StandardSecurity policy per month, rule per month, and requests per million evaluated, globally or regionally scoped policies at different rates; pay-as-you-goEvery policy, every rule, every request through a protected backendYes
Cloud Armor EnterpriseA subscription per month, pay-as-you-go per project or annual per billing account, plus data processing per GiB egress from protected resources in tiers; policies, rules and requests includedAdaptive protection, threat intelligence, DDoS response, named IP listsYes
Purchase optionThe Enterprise annual subscription at a lower data processing rate; nothing on cache egressYes

The cache hit ratio is the lever and the price: a byte served from cache pays the cache egress rate, lower than the load balancer's own internet egress, and a byte missed pays cache fill from the origin plus the origin's own egress and operations plus the cache egress on the way out, so a low hit ratio pays every byte twice. The destination sets the rate: a user in Europe or North America pays the lowest tier, a user in Asia a little more, a user in China twice as much, and the tiers fall after 10, 150 and 1,000 TiB a month per destination. The lookup request is the smallest line but the one that scales with the number of objects: a page of 200 small assets pays 200 lookups per view. Cloud Armor's Standard tier prices its parts, a policy and its rules per month and every request evaluated per million, which on a busy site is the larger part; Enterprise replaces that with a subscription and a fee per GiB of egress from the protected resources, which pays off where the request count is high or the adaptive protection is needed. The mechanics across all three providers are in content delivery networks; what the AWS counterpart costs, in CloudFront pricing.

How it appears in your billing data

In the billing export the CDN rows carry service.description Cloud CDN and a sku.description per kind and destination: Cache Egress Europe, Cache Egress North America, Cache Egress Asia Pacific, Cache Egress China, Cache Fill Intra Region, Cache Fill Inter Region, Cache Fill Inter Continent, Cache Lookup Requests; usage.unit is gibibyte for egress and fill and count for lookups. The load balancer's rows sit under Networking as Forwarding Rule Minimum Service Charge and Data Processing, the origin's under Cloud Storage or the backend's service, so the cost of serving a site is three services wide. Cloud Armor rows carry service.description Cloud Armor with Cloud Armor Security Policy, Cloud Armor Rule per month, Cloud Armor Requests per million for the Standard tier, and Cloud Armor Enterprise Subscription plus Cloud Armor Enterprise Data Processing per GiB for Enterprise. resource.name in the export with resource-level detail names the backend service or the security policy, and the labels of the backend service are the attribution per team; the hit ratio, the bytes per destination and the requests per policy sit in the load balancer's and Armor's metrics, not in the export.

Credits are rare: there is no free tier on Cloud CDN beyond the network's and no commitment on cache egress. The export's structure is described in the Google Cloud billing export; in the FOCUS export, ServiceName carries Cloud CDN or Cloud Armor, ServiceCategory Networking or Security, SkuId the SKU and ChargeCategory Usage (FOCUS columns).

yesnoA request at the edgeA cache lookup, per countHit?Cache egress per GiBby destination continentCache fill per GiB, intra-region,inter-region or inter-continent,plus the origin's own cost,then the egressThe load balancer and Cloud ArmorRows under Networking andSecurity: forwarding rules,policies and requests evaluated
A hit pays a lookup and cache egress by destination, a miss adds the fill and the origin, and the balancer and Cloud Armor sit on their own rows

Levers

Configuration: the first lever is the cache hit ratio through cache keys without query strings and cookies, long TTLs on immutable assets with versioned names, and negative caching, because every miss pays fill, origin and egress; the second is the number of requests, through bundled assets and HTTP/2 so a page needs fewer lookups; the third on Cloud Armor is the policy design, fewer rules with expressions instead of many single rules, and rate limiting at the edge so a burst is dropped before it is evaluated by every rule. The patterns are in data transfer optimisation.

The cache hit ratio: cache keyswithout query strings and cookies,long TTLs on immutable assets withversioned names, negative cachingEvery miss pays fill,origin and egressFewer requests: bundled assetsand HTTP/2, so a page needsfewer lookupsCloud Armor: fewer rules withexpressions instead of many singlerules, rate limiting at the edge soa burst is dropped before it is served
The hit ratio first through cache keys and TTLs, then fewer lookups per page, and on Cloud Armor fewer rules with rate limiting at the edge

Purchase option: the Enterprise annual subscription where the Standard tier's request charge or the data processing under pay-as-you-go exceeds it, which happens on sites past a few hundred million requests a month; nothing on the CDN.

Architecture: the CDN in front of every public asset, because cache egress costs less than the load balancer's egress and the origin's (network pricing, Cloud Storage pricing); Media CDN for video, where its tiers and fill are made for large objects; and an origin near the users' continent, because cache fill across continents costs several times fill within a region. Cloud Armor on every internet-facing load balancer, Standard where the request count is modest, Enterprise where the site is a target.

Where it goes wrong

  • The hit ratio is 30 percent. Query strings in the cache key make every variant a miss; the origin pays fill, operations and egress on 70 percent of requests. A cache key without query strings and cookies is the fix.
  • The assets are not versioned. Short TTLs to keep assets fresh make the cache fetch them again every few minutes. Versioned names with a long TTL serve them from cache for a year.
  • The origin is a continent away. Cache fill from a bucket in North America to European caches pays the inter-continent rate on every miss. A dual-region or a European origin halves the fill.
  • A lookup per icon. A page with 300 small assets pays 300 lookups per view, and at a million views a day the lookups exceed the egress. Bundling and sprites cut them.
  • A rule per IP. A Cloud Armor policy with hundreds of single-IP rules pays each per month and evaluates each per request. Named IP lists and expressions bundle them.
  • The bots pay the request line. Every request, bot or not, is evaluated and billed per million. A rate limit and a bot rule at the top of the policy drop them before the rest.
  • Enterprise on a quiet site. The subscription costs every month whether attacks come or not; a site with a few million requests pays less on Standard. The request count decides.

Example

List prices in USD, read on 2026-10-21 from the Cloud CDN and Cloud Armor pricing pages, the same for an origin in Frankfurt (europe-west3) as elsewhere because the destination sets them: cache egress to Europe and North America costs USD 0.08 per GiB for the first 10 TiB a month, USD 0.055 to 150 TiB, USD 0.03 to 1,000 TiB and USD 0.02 beyond; to Asia Pacific USD 0.09, 0.06, 0.05 and 0.04; to China USD 0.20, 0.17, 0.16 and 0.145; to Oceania USD 0.11, 0.09, 0.08 and 0.065; cache fill USD 0.01 per GiB within a region and up to USD 0.04 across continents; cache lookup requests USD 0.0075 per 10,000. Cloud Armor Standard costs USD 0.006849315 per policy-hour, USD 5 a month, USD 0.001369863 per rule-hour, USD 1 a month, and USD 0.75 per million requests on globally scoped policies or USD 0.60 on regional ones; Cloud Armor Enterprise USD 0.273972603 per hour, USD 200 a month per project on pay-as-you-go, or USD 4.109589041 per hour, USD 3,000 a month, on the annual subscription, plus data processing from USD 0.075 per GiB on pay-as-you-go and USD 0.05 per GiB on the annual subscription for the first 100 TiB.

A site that serves 50 TiB a month to European users through the CDN at a 90 percent hit ratio pays 10,240 × 0.08 plus 40,960 × 0.055 = USD 3,072.00 of cache egress, 5,120 GiB of cache fill within the region USD 51.20, and at 500 million requests USD 375.00 of lookups, USD 3,498.20 in all; the same 50 TiB from the load balancer without the CDN would pay USD 5,324.80 of Premium tier egress to Europe. At a 50 percent hit ratio the fill rises to USD 256.00 and the origin pays egress and operations on 25 TiB. Cloud Armor Standard on that site with one policy of ten rules and 500 million requests costs 5.00 plus 10.00 plus 375.00 = USD 390.00 a month; at 5 billion requests USD 3,765.00, where the Enterprise annual subscription with data processing on 50 TiB, 3,000 plus 2,560 = USD 5,560.00, is still dearer and pays off only with its protection. The figures show that cache egress undercuts the load balancer's egress by about a third, that the hit ratio decides whether the origin's lines appear at all, and that on Cloud Armor the requests, not the rules, carry the line.

Sources

Read on 2026-10-21. Prices: Cloud CDN pricing, Cloud Armor pricing, Cloud Load Balancing pricing. Service: Cloud CDN caching overview, Cloud Armor tiers. Billing data: structure of the standard Cloud Billing data export.