TL;DR
Putting CloudFront in front of S3 is the standard answer to high data transfer costs. For one video streaming platform serving African users, the numbers showed the opposite. Moving the origin bucket was ~$205/month cheaper per 10 TB than adding a CDN, before request charges. Architecture is a set of trade-offs, and consensus is not a cost model.
The Problem Nobody Tags
If you've spent time in AWS Cost Explorer, you know the feeling. A large, vague line item called EC2-Other, or a pile of untagged spend that nobody owns.
Dig into it and one culprit keeps showing up: data transfer.
It's the cost that doesn't appear on any architecture diagram. Storage is cheap and predictable. Compute is visible. But every byte that leaves AWS for the internet, or crosses a region boundary, gets metered. What you pay depends on decisions most teams never revisit:
- Which region your data lives in
- Whether traffic crosses regions or stays local
- Whether you route over private networking or the public internet
- Which delivery layer, if any, sits between your origin and your users
AWS keeps your data secure in transit by default. How much you pay for that transit is entirely on you.
The Scenario
A client runs an online learning platform. Course videos are stored in Amazon S3. When a user signs up, the web application grants them access to specific videos through S3 presigned URLs, and playback streams directly from the bucket.
Simple. Functional. Expensive.
The monthly bill told the story:
| Cost Component | Monthly Spend |
|---|---|
| S3 Storage | A few hundred USD |
| Data Transfer Out | $9,000 to $10,000 |
Storage was a rounding error. Transfer was the whole bill.
One more constraint shaped everything: the platform's audience is primarily in Africa. Performance was already acceptable. The brief was purely cost reduction.
The Textbook Fix
An engineer on the project proposed the standard answer:
- Put Amazon CloudFront in front of the S3 bucket
- Cache videos at the edge so repeat views don't hit the origin
- Replace S3 presigned URLs with CloudFront signed cookies for access control
On paper, this is a great design. Lower latency, less origin load, cleaner access control, and it's what every blog post and re:Invent talk recommends.
So before approving it, we did the one thing that consensus skips: we priced it.
Running the Numbers
Benchmark assumptions (one month):
- 10 TB delivered to users on the internet
- 5 TB fetched from origin (cache misses)
- Users served from South African edge locations
- On-demand pricing, no committed-use discounts
Note: 10 TB is a benchmark, not the client's real volume. Their actual monthly transfer is several times higher, which is how the bill reached $9,000 to $10,000. Treat these figures as a per-10 TB unit cost. The gap between options grows as volume grows.
We modeled three options.
Option A: S3 direct, bucket in af-south-1 (Cape Town)
| Item | Cost |
|---|---|
| 10 TB S3 transfer out to internet | $1,576 |
| Total | $1,576 |
Option B: CloudFront in front of S3
The origin bucket sits in eu-west-1 (Ireland). CloudFront is a global service, so it isn't deployed to a region. African viewers are served from CloudFront's South African edge locations, billed at the Africa pricing tier. Transfer from S3 to CloudFront on cache misses is free.
| Item | Cost |
|---|---|
| 10 TB CloudFront transfer out (South Africa edge) | $1,126 |
| Total | $1,126 |
Not included: CloudFront HTTPS request charges, which push this total higher.
Option C: S3 direct, bucket in eu-west-1 (Ireland)
| Item | Cost |
|---|---|
| 10 TB S3 transfer out to internet | $921 |
| Total | $921 |
Side by side
| Option | Monthly Cost (10 TB) | vs. Cheapest |
|---|---|---|
C: S3 direct, eu-west-1
|
$921 | Baseline |
B: CloudFront + S3 (eu-west-1 origin) |
$1,126+ | +$205 (+22%) |
A: S3 direct, af-south-1
|
$1,576 | +$655 (+71%) |
What the Numbers Actually Say
CloudFront beats the current setup by about 29%. If the only comparison was A vs. B, the CDN looks like a win and everyone moves on.
But the real saving wasn't in adding a layer. It was in moving the origin.
Data transfer out from af-south-1 is priced well above the major European and US regions. By relocating the bucket to eu-west-1, transfer cost dropped by over 40% without adding a single new service.
Serving African users from Ireland does add latency compared to Cape Town. For this client, playback stayed within acceptable limits, so the trade-off was worth it.
Adding CloudFront on top would have increased cost by ~$205 for every 10 TB, before request charges. The client moves several times that each month, so the difference multiplies with every additional 10 TB served.
The "perfect" architecture would have optimized the wrong variable.
Why This Happens
Four things combined here:
- Regional pricing is not uniform. The same gigabyte costs different amounts depending on where it leaves AWS. Newer and opt-in regions often carry a premium.
- CDN edge pricing follows the viewer. CloudFront bills based on where users are served from, and African edge locations sit in one of the more expensive pricing tiers. A CDN doesn't erase that, it just moves it.
- Caching only pays off with high reuse. Video catalogs with a long tail of content and a 50% cache miss rate (5 TB fetched from origin vs. 10 TB delivered) don't get the cache leverage a CDN needs to win on cost.
- Video multiplies request charges. CloudFront bills per request on top of per GB. Video players fetch content in many small range requests rather than one large file, so request charges quietly stack up on top of the transfer cost.
When CloudFront Is the Right Answer
This isn't an anti-CDN post. CloudFront is the right call when:
- Performance is the deciding factor. Global audiences, latency-sensitive playback, or SLA commitments.
- Cache hit ratio is high. A small set of popular videos watched repeatedly.
- Volume is low enough that the free tier covers most of it.
- Volume is high enough to negotiate CloudFront private pricing or commit to a Savings Bundle.
- You need edge features: WAF, geo-restriction, signed cookies at scale, origin shielding, or DDoS protection.
- Your users are where CDN pricing is cheapest, such as North America or Europe.
A Decision Framework You Can Reuse
Before adopting any "best practice" architecture, ask:
- What is the actual objective? Cost, performance, reliability, or security. Rank them.
- Where are my users, and where is my data? Price the distance between them.
- What is my cache hit ratio? Measure it or estimate it honestly.
- Have I priced every option, including "change nothing but location"? The cheapest fix is often a move, not an addition.
- What does it cost at 2x and 5x current volume? Pick the option that still wins as you grow.
Run it through the AWS Pricing Calculator before it goes on a diagram.
Final Thoughts
The best architecture isn't the one with the most components or the most upvotes. It's the one that fits the business goal.
For this client, the most effective cost optimization was a region change. No new service, no new failure mode, no new bill line.
Majority opinion is a starting point, not a decision. Check the cost, the performance, the reliability, and the business goal before you commit to a solution.
Have you seen a "best practice" backfire on cost? Drop it in the comments.
Pricing based on AWS on-demand rates at time of writing. Always validate against current pricing for your regions and volumes.
Top comments (0)