CloudFront vs S3 Direct: Real Cost Breakdown and When to Use Each

The CloudFront vs S3 decision depends more on object size than on traffic volume. At a 500 KB average response, 100 TB a month costs roughly $7,163 through Amazon CloudFront pay-as-you-go and $7,871 served directly from an Amazon S3 bucket in us-east-1, but the ranking flips when average responses fall below about 120 KB. This article covers the billing lines on each path, worked costs at 1, 10 and 100 TB, a break-even rule you can apply to your own logs, origin access control setup, and a best-fit matrix by workload.

Amazon CloudFront does not charge for fetching objects from an S3 origin, and its US and Europe delivery rate starts at $0.085 per GB, against $0.09 per GB for S3 internet egress (CloudFront published price lists checked August 2026, S3 us-east-1 list prices as of 2025). CloudFront's HTTPS request fee of $0.01 per 10,000 is 2.5 times S3's $0.004 per 10,000 GET requests, so serving from S3 directly is cheaper per GB whenever the average response is smaller than about 120 KB.

Evaluated October 2026. Storage is excluded from every comparison below because it is identical on both paths: 5 TB in S3 Standard costs about $115 a month at $0.023 per GB.

Billing lines compared: CloudFront vs S3 on each delivery path

AWS bills four components when S3 sits behind CloudFront: S3 storage, S3 requests, CloudFront delivery and CloudFront requests. When you serve from S3 directly, CloudFront drops out and S3 egress replaces it.

• S3 direct: internet transfer at $0.09 per GB to 10 TB, $0.085 to 50 TB, $0.07 to 150 TB and $0.05 beyond, after a 100 GB monthly allowance shared across AWS. GET requests cost $0.0004 per 1,000.
• CloudFront with an S3 origin: origin fetch costs $0. US and Europe delivery is $0.085 per GB to 10 TB, $0.080 to 50 TB, $0.060 to 150 TB and $0.040 to 500 TB. HTTPS requests cost $0.01 per 10,000, S3 GETs apply only on cache misses, and a standing allowance covers 1 TB and 10 million requests a month.
• CloudFront extras: invalidations beyond the first 1,000 paths a month at $0.005 per path, Origin Shield request fees, and per-invocation edge functions.
• S3 extras: cross-region replication transfer if you copy buckets closer to users, and Transfer Acceleration if enabled.

S3 vs CloudFront cost at 1, 10 and 100 TB a month

With 500 KB average responses and a 90 percent cache hit ratio, CloudFront pay-as-you-go costs about $0 at 1 TB, $776 at 10 TB and $7,163 at 100 TB. S3 direct costs $82, $899 and $7,871 for the same traffic. The CloudFront allowance decides the 1 TB case, and per-GB rates decide the rest.

Assumptions: decimal terabytes, US and Europe viewers, HTTPS only, 2 million requests per TB, and 10 percent of CloudFront requests reaching S3. Flat-rate plan figures come from published price lists, checked August 2026.

At 500 KB responses, CloudFront pay-as-you-go undercuts S3 direct by about $82 at 1 TB, $123 at 10 TB and $708 at 100 TB, and the flat-rate plans widen that gap further.

Where the CloudFront S3 cost math flips: small objects

CloudFront S3 cost exceeds S3 direct when the average response is below about 120 KB in the first two pricing tiers, or below about 60 KB once both services reach their 50 to 150 TB tiers. Below those sizes, CloudFront's higher per-request fee outweighs its lower per-GB rate.

Here is the arithmetic. In the first tier, CloudFront saves $0.005 per GB on egress but charges $0.0000006 more per request ($0.000001 against $0.0000004). The saving and the extra charge break even at 8,333 requests per GB, which is 120 KB per response. Between 50 and 150 TB, the egress gap doubles to $0.01, so the break-even response size halves to 60 KB. Cache-miss GETs move the break-even point by only a few KB. Small thumbnails, JSON manifests and sprite fragments with low reuse are the workloads where this matters.

Above 100 TB: when a third CDN beats both paths

At high volume, the realistic comparison is CloudFront against a volume CDN that pulls from the same bucket. A CDN outside AWS pays S3 egress on every cache miss: at a 95 percent hit ratio on 100 TB, that is 5 TB of misses, or about $441. The BlazingCDN vs Amazon CloudFront billing comparison sets out both models line by line.

As of October 2026, BlazingCDN prices delivery on progressive tiers from $5 per TB down to $2.50 per TB at volume, with one rate for the US, Europe and Asia and no request fees. At 100 TB a month that totals $415, against $6,965 for CloudFront pay-as-you-go transfer alone (published price lists, checked August 2026). Current rates are on the BlazingCDN pricing page.

Adding the S3 miss egress gives about $856 a month for BlazingCDN. The limits are real, though. BlazingCDN does not support HTTP/3 and sells no WAF or DDoS mitigation, so you keep your existing security stack. Below about 46 TB a month, published flat plans such as Amazon CloudFront Business ($200 for 50 TB) or Cloudflare Pro can cost less.

Regional pricing and CloudFront price classes

CloudFront bills by the edge location that serves the viewer. Outside the US and Europe, first-tier rates rise to roughly $0.11 to $0.12 per GB in Asia-Pacific, South America, India, the Middle East and Africa (approximate list prices). S3 egress is priced by the bucket's region, not the viewer's, so an us-east-1 bucket serving viewers in Brazil still pays $0.09 per GB.

For latency-tolerant bulk downloads aimed at those regions, S3 direct can be cheaper per GB. Price Class 100 limits serving to edges in North America, Europe and Israel. It caps the rate at US and Europe levels, but distant viewers pay for it in round-trip time.

Performance: latency, TLS and origin load

S3 terminates every TLS handshake in the bucket's region. A viewer in Singapore reaching us-east-1 typically sees round trips of 200 to 250 ms. A cold TLS 1.3 connection plus the first request therefore takes three round trips, roughly 0.6 to 0.75 seconds, before any payload arrives. CloudFront terminates TLS at the edge, speaks HTTP/2 and HTTP/3 to viewers, and keeps warm connections to the origin.

Origin load matters too. AWS documents a per-prefix ceiling of 5,500 GET or HEAD requests per second, above which clients receive 503 Slow Down errors. A 90 percent hit ratio cuts the origin request rate tenfold. S3 also cannot serve HTTPS on your own domain: the website endpoint is HTTP only, and the REST endpoint presents an amazonaws.com certificate.

How to lock the bucket with origin access control (OAC)

Origin access control replaced the legacy origin access identity in 2022. It signs origin requests with SigV4, supports SSE-KMS, and works in all regions. Set it up in this order:

1. In the CloudFront console, create an origin access control with origin type S3 and signing behavior set to always sign requests.
2. Point the distribution origin at the bucket's regional REST endpoint, not the static website endpoint. Website endpoints are custom origins and cannot use OAC.
3. Add a bucket policy statement that allows s3:GetObject for the service principal cloudfront.amazonaws.com, with a StringEquals condition on AWS:SourceArn set to your distribution ARN.
4. Keep S3 Block Public Access enabled, remove any public-read statements, and set Object Ownership to bucket owner enforced.
5. If objects use SSE-KMS, grant kms:Decrypt in the key policy to the same principal with the same SourceArn condition.

To verify, request an object by its S3 URL and expect 403 AccessDenied, then request it through the distribution and expect 200 with an X-Cache value of Hit from cloudfront on the repeat request. Without s3:ListBucket, missing keys return 403 instead of 404. To roll back from a failed OAI migration, keep both policy statements until the distribution reports Deployed, then delete the OAI statement.

When is serving directly from S3 fine?

Serving from S3 directly is fine when consumers sit inside AWS, when downloads are private and rarely repeated, or when average responses fall below the 120 KB break-even and latency is not critical. In-region EC2 or Lambda reads from S3 incur no transfer charge, and a VPC gateway endpoint keeps that traffic off NAT gateways.

• Presigned one-off downloads such as exports, invoices and backups.
• Public datasets on Requester Pays buckets, which only work against S3 itself.
• Data pipelines, replication targets and internal tooling.
• Private APIs serving objects to authenticated services inside a VPC.

Best fit by workload: CloudFront or S3 direct

Response size and reuse decide the path more reliably than total traffic volume.

Five ways to cut the bill on either path

1. Enable Origin Shield when several regions miss on the same objects. It consolidates misses into fewer S3 GETs but adds its own request fee, so check the net saving.
2. Use S3 Intelligent-Tiering for aging assets. Objects under 128 KB are not auto-tiered, which matters for thumbnail-heavy buckets.
3. Consider a CloudFront Security Savings Bundle: up to 30 percent off CloudFront charges in exchange for a one-year monthly spend commitment.
4. Restrict price classes when your audience is concentrated in North America and Europe.
5. Compare alternative CDNs for large, publicly cacheable media, and include S3 miss egress in the math.

Also budget for invalidations past the monthly allowance and for replication transfer. Then pull 90 days of Cost Explorer data grouped by usage type and compute your blended cost per delivered GB.

FAQ: CloudFront vs S3 cost and setup

Is CloudFront cheaper than serving files directly from S3?

Usually, yes, for public delivery of objects larger than about 120 KB. CloudFront's US and Europe rate starts at $0.085 per GB against S3's $0.09, and origin fetches from S3 cost nothing. For small, rarely reused objects, CloudFront's $0.01 per 10,000 HTTPS request fee can make S3 direct cheaper per delivered GB.

Does AWS charge for data transfer from S3 to CloudFront?

No. AWS does not bill transfer from an S3 origin to CloudFront edge locations, whichever region the bucket is in. You still pay S3 GET request fees on every cache miss, plus CloudFront delivery and request charges to viewers. Origin Shield adds its own per-request fee, which you should weigh against the GETs it saves.

What is the S3 vs CloudFront cost difference at 10 TB a month?

With 500 KB average responses, S3 direct costs about $899 and CloudFront pay-as-you-go about $776 at 10 TB, using 2025 S3 list rates and CloudFront prices checked August 2026. CloudFront's published Business flat-rate plan, at $200 for up to 50 TB, lowers the CloudFront figure further if its terms fit your workload.

Can CloudFront origin access control work with an S3 website endpoint?

No. Origin access control only works with the S3 REST endpoint, because S3 static website endpoints are treated as custom origins. To keep index-document behavior on a locked bucket, set a default root object in CloudFront and handle subdirectory index rewrites with a CloudFront Function that runs on viewer requests.

When should I serve files from S3 instead of CloudFront?

Serve from S3 directly for in-region AWS consumers, presigned one-off downloads, Requester Pays datasets and internal pipelines. Those paths either incur no transfer charge or gain nothing from edge caching. Public, repeatedly requested content benefits from CloudFront's lower per-GB rate, edge TLS termination and reduced origin request rate.

Run the break-even check on your own traffic

This week, export 30 days of CloudFront and S3 usage. Divide bytes downloaded by request count for each distribution or bucket to get the average response size, then compare it with the 120 KB and 60 KB break-even points above. Add your measured hit ratio and the regional mix of your viewers, and compute a blended cost per delivered GB for each path. If any distribution sits below the break-even size with low reuse, test S3 direct or a flat-rate plan for it. If the large-object distributions dominate the bill, price them as a separate line item.

For high-volume large files, the BlazingCDN CDN cost calculator prices the same monthly traffic on progressive tiers starting at $5 per TB, with no request fees.