Cloud egress: S3 direct vs CloudFront origin path

Path matrix: S3 direct Internet vs CloudFront origin-fill cost layers (educational)
Path class	S3 direct (client←S3)	CloudFront + S3 origin	FinOps note
Client-facing bill	S3 Internet egress tiers	CloudFront data transfer out	Edge vs origin SKU names differ
Origin / storage bill	Same as client path	Origin fill / S3→CF bytes may bill	Two-bill risk on misses
Free-tier / free grant	S3 free tier cliffs	CF free tier + S3 free grant interact	Model cliffs explicitly
Cache hit ratio	N/A (always origin)	CHR drives origin fill ≈ client×(1−CHR)	Measure per path
Signed URL / private	Presigned S3 GET	CF signed URLs + OAI/OPA patterns	Auth changes cacheability

Path matrix: S3 direct Internet vs CloudFront origin-fill cost layers (educational)

Path class

S3 direct (client←S3)

CloudFront + S3 origin

FinOps note

Client-facing bill

S3 Internet egress tiers

CloudFront data transfer out

Edge vs origin SKU names differ

Origin / storage bill

Same as client path

Origin fill / S3→CF bytes may bill

Two-bill risk on misses

Free-tier / free grant

S3 free tier cliffs

CF free tier + S3 free grant interact

Model cliffs explicitly

Cache hit ratio

N/A (always origin)

CHR drives origin fill ≈ client×(1−CHR)

Measure per path

Signed URL / private

Presigned S3 GET

CF signed URLs + OAI/OPA patterns

Auth changes cacheability

Provider source footnotes

Dated starting points only — Unknown until verified means no invented $/GB. PipeToll does not scrape private consoles or guarantee figures.

Path-class vocabulary: path template, Unknown until verified. Path-first: client ← Internet ← S3 versus client ← CloudFront ← S3 origin. PipeToll refuses to crown a winner from a single blog $/GB. Titles lead with Cloud egress so readers are not hunting American pipe-toll brands.

Path templates to model

Public website assets from S3 website endpoint — direct Internet egress; no CHR lever.
Same objects behind CloudFront with long TTL — edge transfer + miss-driven origin fill.
Presigned S3 URLs emailed to partners — often uncacheable; behaves like direct.
CloudFront with Origin Access Control to private bucket — auth + cache policy shape fill bytes.
Byte-range / video from S3 via CF — range misses inflate origin fill beyond naive CHR.

Common traps

Assuming “CDN = zero S3 egress” ignores origin fill. Comparing only CloudFront $/GB to S3 Internet $/GB without free-tier cliffs mis-ranks quiet months. Blending request SKUs into egress lines hides LIST/GET taxes. No guaranteed savings from enabling CloudFront without measured CHR.

FinOps checklist

Export client download GB and, if CF-enabled, cache hit ratio by path.
Price direct S3 Internet path with Mode A (?mode=gb&path=s3-direct).
Price CF path with edge GB + Mode C origin fill.
Mark unverified rates Unknown until verified per methodology.
Cross-read CDN origin fill, S3 vs R2, and free-tier cliff.

FinOps-lite Unknown until verified

Worked example (educational): 8 TB client downloads, 75% CHR

Direct path: price 8,000 GB on S3 Internet egress tiers (Mode A). CloudFront path: edge bill for ~8,000 GB plus origin fill ≈ 2,000 GB × origin $/GB (Mode C). Free-tier cliffs on either product can flip totals — keep Unknown until dated. Not a savings guarantee for “just add CloudFront.”

FAQ on this path

Does CloudFront remove S3 egress?

It can shift who bills client bytes to CloudFront, but origin fill on cache misses may still bill S3 or CF origin fees. Model both meters.

When is S3 direct simpler?

Low-CHR or one-shot downloads where CDN edge fees add little; still watch S3 free-tier cliffs and request SKUs.

How should I estimate origin fill?

origin_GB ≈ client_GB × (1 − CHR) × inflation — see the CDN origin spoke and calculator Mode C.