Cloud NAT and the per-gigabyte processing behind it.
Cloud NAT lets instances without external IP addresses reach the internet, and bills for every gigabyte that passes through it — inbound as well as outbound. That is the detail that surprises people: downloads are charged too, and the NAT charge stacks on top of internet egress for outbound traffic.
Billed: Per gibibyte processed through the NAT gateway, in BOTH directions, plus an hourly charge per gateway.