Cloud egress: CloudFront vs Cloudflare CDN origin path
CloudFront and Cloudflare CDN logos are not interchangeable meters. Map edge transfer versus origin-fill path classes before comparing bills — Unknown until verified. Miss-driven fill belongs in Mode C (?path=cf-cloudflare); S3/R2 Internet GET and free-tier cliffs stay sibling spokes, not a single blended CDN $/GB. Enabling either CDN is not a savings guarantee.
Updated
CDN logos are not interchangeable meters — map edge transfer versus origin fill before comparing CloudFront and Cloudflare paths.
Path matrix: CloudFront vs Cloudflare CDN edge and origin meters (educational)
Dated starting points only — Unknown until verified means no invented $/GB. PipeToll does not scrape private consoles or guarantee figures.
Compare origin paths, not brand slides. Both CloudFront and Cloudflare CDN can deliver bytes at the edge; FinOps risk lives in miss-driven origin fill, plan cliffs, and request/CPU add-ons. Educational only — FinOps-lite, not a broker.
Path templates to model
Browser ← CloudFront ← S3 (OAC) — edge DT + miss-driven S3/CF origin bytes; see also S3 direct vs CloudFront.
Browser ← Cloudflare ← R2 / custom origin — edge plan rules + origin provider egress on misses.
Browser ← Cloudflare ← S3 origin — cross-vendor: Cloudflare edge + AWS origin fill (source often pays).
API with short TTL — low CHR; origin fill dominates; Mode C sensitivity first.
Byte-range / video — range misses inflate fill beyond naive CHR; track media paths separately.
Common traps
Assuming “CDN = zero origin egress.” Comparing only CloudFront regional $/GB to a Cloudflare plan headline without measuring CHR. Blending Workers/Lambda@Edge CPU into egress lines. Treating shield/tiered cache as free HA without byte accounting. Pasting an S3/R2 Internet GET rate into the origin-fill cell (or vice versa) — keep S3 vs R2 and Mode C separate. Ignoring origin-side free-tier cliffs when origin is AWS. No scorecrowns from Incomplete cells — keep Unknown until verified.
CDN = zero origin egress — edge hits avoid origin GETs; misses still bill origin fill. CHR is an input, not a marketing constant — re-measure after cache-policy changes.
Edge $/GB vs plan headline — CloudFront regional tiers and Cloudflare plan bandwidth are different shapes. Never paste one headline into the other’s cell; keep Mode C for fill and a separate edge line.
CPU blended into egress — Workers / Lambda@Edge compute is not DT-out. Keep CPU/request meters off the egress ledger so CE labels stay honest — sibling Cost Explorer decoder.
Shield / tiered cache as free HA — mid-tier caches move bytes between layers. Model shield/tiered fill as its own path class when you turn it on; do not assume $0 HA.
Wrong origin rate pasted — S3 Internet GET ≠ R2 egress posture ≠ CloudFront origin fetch. Keep S3 vs R2, S3 direct vs CloudFront, and Mode C separate.
Origin-side cliff ignored — when origin is AWS Internet DT-out, the free-tier cliff still applies on misses. Edge plan bandwidth does not erase origin cliffs.
Incomplete → crown — Unknown cells stay Unknown. No scorecrown CloudFront vs Cloudflare. Stay FinOps-lite; no savings guarantee.
FinOps checklist
Export client GB and CHR (or miss ratio) by cache policy for 30–90 days.
Name the origin owner (S3, R2, compute) and which bill moves on misses.
Worked example (educational): 12 TB client downloads at 82% CHR
Users pull 12,000 GB via CDN. At 0.82 CHR, origin fill ≈ 2,160 GB.
Price edge delivery and origin fill as separate lines — Mode C for fill via ?mode=origin&path=cf-cloudflare, Mode A for edge if you have a verified edge $/GB.
Placeholder rates stay Unknown. Name the origin owner (S3, R2, compute) before arithmetic.
Enabling either CDN is not a guaranteed savings claim versus the other or versus direct origin GET.
Second educational stack (failover / CHR drop): same 12 TB client month, CHR falls from 0.82 → 0.60 after a bad cache policy → fill ≈ 4,800 GB. Re-run Mode C; do not keep the old fill line. Twin path: Cloudflare edge ← S3 origin (cross-vendor) still bills AWS origin fill on misses — pair with S3 vs R2 and the free-tier cliff spoke when origin is AWS Internet DT-out.
Hold the 12 TB (12,000 GB) client baseline and walk three CHR / origin runs. Every unit rate stays Unknown until dated CloudFront / Cloudflare / origin cites — literacy arithmetic, not a quote.
Run A — CHR 0.82: origin fill ≈ 2,160 GB. Price edge delivery and origin fill as separate lines — Mode C (?path=cf-cloudflare) for fill; Mode A only if you have a verified edge $/GB.
Run B — CHR drop 0.82 → 0.60: fill ≈ 4,800 GB after a bad cache policy. Re-run Mode C; do not keep the old fill line. Twin: failover / purge storms behave the same way.
Run C — cross-vendor origin (Cloudflare edge ← S3): same 12 TB client; misses still bill AWS origin fill. Pair with S3 vs R2 and the free-tier cliff when origin is AWS Internet DT-out; multi-edge physics on multi-CDN origin fill.
Sensitivity runs — Unknown rates (educational)
Run
What changes
Meters to keep visible
Unit rates
A
12 TB client · CHR 0.82
Edge delivery · origin fill ≈ 2,160 GB
Unknown
B
Same client · CHR 0.60
Edge delivery · origin fill ≈ 4,800 GB
Unknown
C
Cloudflare edge ← S3 origin
Edge plan · AWS origin fill (+ cliff if applicable)
No. Origin fill still moves bytes from whatever hosts the origin (S3, R2, VPS, etc.). Marketing for edge bandwidth is not the same as zero origin bill.
When is CloudFront simpler to model on AWS?
When origin is already S3/EC2 in-account and you want AWS-native OAC/OAI patterns — simplicity ≠ guaranteed lower spend.
What metric first?
Client download GB, CHR by path, and which invoice line (CDN vs origin storage/compute) moves when misses rise.
How should Mode C be used on this spoke?
Mode C estimates origin fill ≈ client_GB × (1−CHR) × origin $/GB. Deep-link ?mode=origin&path=cf-cloudflare. Keep edge delivery $/GB (if any) on a separate Mode A line. Synthetic educational only.
Does a CHR drop change which spoke I read?
Re-run Mode C on this page and CDN origin fill. If origin is S3/R2, also re-check S3 vs R2 and any AWS free-tier cliff on origin Internet DT-out. Multi-vendor edges: see multi-CDN origin fill.
Trademarks: Amazon Web Services, AWS, Microsoft Azure, Google Cloud Platform, GCP, and Cloudflare are trademarks of their respective owners. PipeToll (Ameti One LLC) is not affiliated with, endorsed by, or sponsored by those companies. Educational comparisons may be outdated — verify current rates with each provider.
