Egress per vendor
AWS: $0.09 per GB after the free tier. Azure: tiered, similar floor. GCP: tiered, similar floor. Cloudflare: bundled. The cheapest egress is the one you never generate; cache aggressively at the edge.
Log shipping
API access logs at 1 KB per call to a Splunk index that prices at $1,800 per GB ingested per year add up fast. At 100M calls per month, that is 100 GB per month, or about $180,000 per year of Splunk ingest alone before the SIEM analyst tier.