Egress

Outbound traffic leaves project networks toward the internet, VPN peers, or other VPCs and often meters separately. Spikes may signal exfiltration, misconfigured mirrors, or backup jobs. Security groups and routes must allow return paths for established flows.