Public S3 Internet GETs and CloudFront-origin fills are different meters: direct downloads bill S3/Internet DT-out, while CF can shift client bytes to edge transfer and leave origin fill on misses. Map who pays, measure CHR, and keep S3 CRR off the origin-fill line before comparing $/GB — Unknown until verified. Decode CE labels and free-tier cliffs on both products.
Updated
Public S3 downloads and CloudFront-origin fills are different meters — map who pays before comparing $/GB.
Path matrix: S3 direct Internet vs CloudFront origin-fill cost layers (educational)
Public website assets from S3 website endpoint — direct Internet egress; no CHR lever.
Same objects behind CloudFront with long TTL — edge transfer + miss-driven origin fill.
Presigned S3 URLs emailed to partners — often uncacheable; behaves like direct.
CloudFront with Origin Access Control to private bucket — auth + cache policy shape fill bytes.
Byte-range / video from S3 via CF — range misses inflate origin fill beyond naive CHR.
Common traps
Assuming “CDN = zero S3 egress” ignores origin fill. Comparing only CloudFront $/GB to S3 Internet $/GB without free-tier cliffs mis-ranks quiet months. Blending request SKUs into egress lines hides LIST/GET taxes. Treating S3 CRR as CloudFront origin fill conflates replication with CDN miss traffic — keep CRR on its own spoke. Pasting a CE “Data Transfer” rollup without path class is unsafe — use the CE decoder. No guaranteed savings from enabling CloudFront without measured CHR.
CDN = zero S3 egress — edge hits avoid origin GETs; misses still bill origin fill (S3→CF or CF origin fees). CHR is an input, not a marketing constant — re-measure after cache-policy changes.
Edge $/GB vs S3 Internet $/GB alone — CloudFront regional tiers and S3 Internet DT-out are different meters. Never paste one headline into the other’s cell; keep Mode A for direct and Mode C for fill.
Free-tier cliff ignored — Quiet months can flip rankings when S3 or CloudFront grants cliff. Model cliffs explicitly — sibling AWS free-tier cliff.
Request SKUs blended into egress — LIST/GET/PUT taxes are not DT-out. Keep request meters off the egress ledger so CE labels stay honest.
CRR pasted as origin fill — S3 CRR is bucket→bucket replication, not CDN miss traffic. Keep CRR on its own spoke.
CE rollup without path class — “Data Transfer” may mix S3 Internet, CloudFront edge, and origin fill. Decode on the CE decoder before Mode A/C.
Signed URL / private assumed cacheable — Presigned S3 GETs and auth-heavy CF policies often behave like direct (low CHR). Measure before crowning CDN.
Incomplete → crown — Unknown cells stay Unknown. Enabling CloudFront is not a guaranteed savings claim vs S3 direct. Stay FinOps-lite.
FinOps checklist
Export client download GB and, if CF-enabled, cache hit ratio by path.
Worked example (educational): 8 TB client downloads, 75% CHR
Direct path: price 8,000 GB on S3 Internet egress tiers (Mode A). CloudFront path: edge bill for ~8,000 GB plus origin fill ≈ 2,000 GB × origin $/GB (Mode C). Free-tier cliffs on either product can flip totals — keep Unknown until dated. Not a savings guarantee for “just add CloudFront.”
Second educational stack (low-CHR twin): same 8,000 GB client downloads at 40% CHR → origin fill ≈ 4,800 GB. Re-run Mode C (?path=s3-cf) and compare to the 75% CHR case — CHR, not blog $/GB, usually dominates. If some of those bytes are actually S3 CRR (bucket→bucket), switch to ?path=s3-crr and the CRR spoke. Synthetic only — Unknown rates until dated; no savings guarantee.
Worked-estimate sensitivity (educational)
Hold the 8,000 GB (8 TB) client baseline and walk three CHR / path runs. Every unit rate stays Unknown until dated S3 / CloudFront cites — literacy arithmetic, not a quote.
Run A — high CHR (0.75): direct path prices 8,000 GB on S3 Internet (Mode A). CF path: edge ~8,000 GB + origin fill ≈ 2,000 GB (Mode C). Open Mode C (?path=s3-cf) and Mode A (?path=s3-direct).
Run B — low CHR (0.40): same 8,000 GB client → fill ≈ 4,800 GB. Re-run Mode C; do not keep the 75% CHR fill line. CHR, not blog $/GB, usually dominates.
Run C — signed-URL / CRR twin: uncacheable presigned GETs behave like direct (CHR ~0). If some bytes are actually S3 CRR (bucket→bucket), switch to ?path=s3-crr and the CRR spoke — keep CRR off the origin-fill cell. Free-tier cliffs still apply on the Internet half — AWS free-tier cliff.
Sensitivity runs — Unknown rates (educational)
Run
What changes
Meters to keep visible
Unit rates
A
8 TB client · CHR 0.75
S3 Internet or CF edge · origin fill ≈ 2,000 GB
Unknown
B
Same client · CHR 0.40
CF edge · origin fill ≈ 4,800 GB
Unknown
C
Signed-URL direct / CRR twin
Direct-like egress or CRR (not origin fill) · free-tier cliff
It can shift who bills client bytes to CloudFront, but origin fill on cache misses may still bill S3 or CF origin fees. Model both meters.
When is S3 direct simpler?
Low-CHR or one-shot downloads where CDN edge fees add little; still watch S3 free-tier cliffs and request SKUs.
How should I estimate origin fill?
origin_GB ≈ client_GB × (1 − CHR) × inflation — see the CDN origin spoke and calculator Mode C.
Does CloudFront origin fill include S3 Cross-Region Replication?
No. Origin fill is CDN miss traffic toward the origin. S3 CRR is bucket→bucket inter-region replication — keep CRR off the CloudFront/origin-fill line.
Is origin fill the same as S3 Cross-Region Replication?
No. Origin fill is CDN miss traffic toward the origin (glossary). S3 CRR is bucket→bucket inter-region replication — keep CRR off the CloudFront/origin-fill line.
How do Cost Explorer labels confuse this path?
CE may roll “Data Transfer” without saying S3 Internet vs CloudFront edge vs origin fill. Decode labels on the CE decoder before Mode A/C.
Trademarks: Amazon Web Services, AWS, Microsoft Azure, Google Cloud Platform, GCP, and Cloudflare are trademarks of their respective owners. PipeToll (Ameti One LLC) is not affiliated with, endorsed by, or sponsored by those companies. Educational comparisons may be outdated — verify current rates with each provider.
