All cheat sheets
Networkingcheat sheet

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided CloudFront Egress Discounts walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Serving users straight from S3/EC2/ALB bills Data Transfer Out at $0.09/GB. CloudFront's rates start slightly lower ($0.085/GB in NA/EU) and fall to $0.02/GB at volume — and every cache hit is a request your origin never serves. Adding the middleman cuts the bill 30–55% on static-heavy traffic while making the site faster. The savings vanish only when nothing is cacheable.

The numbers

  • Direct S3/EC2 egress: ~$0.09/GB (first 10 TB tier) · CloudFront: ~$0.085/GB down to ~$0.02/GB at high volume, plus ~$0.01 per 10k HTTPS requests
  • Field examples from the source workflow: a video startup at 80 TB/month went $7,200 → $3,200/month (rate delta + cache hits); a B2B SaaS cut $2,500 → $1,600/month and fixed APAC load times; an e-commerce site saved $2,500/month combined when offloading images also let them downsize the EC2 fleet
  • 400+ edge locations; users get served from nearby instead of your origin region

Do this

  1. Pull Data Transfer Out from Cost Explorer. Climbing into hundreds/month = a candidate.

  2. Start with static assets (images, JS/CSS, fonts, downloads, video): S3 origin + Origin Access Control (bucket stays private), point asset URLs at the distribution. Skip HTML/caching-invalidation complexity until comfortable.

  3. Tune the three savings levers:

    • TTLs — longer cache lifetimes = fewer origin fetches; aim for an 80%+ cache hit ratio (CloudWatch reports it).
    • Compression — let CloudFront gzip/brotli text content; smaller bytes = smaller bill.
    • Price class — users mostly in NA/EU? Price Class 100 skips the expensive edge regions entirely.

  4. Watch the hit ratio after launch. A low ratio means cache keys are fragmenting (cookies, query strings, headers) — fix the cache policy before judging the savings.

Gotchas

  • Personalized/dynamic responses don't cache — you pay origin fetch and CloudFront delivery; purely dynamic APIs can cost slightly more behind a CDN.
  • Same-region AWS-to-AWS traffic is already free — putting CloudFront in an internal path adds cost where there was none.
  • Request fees exist — billions of tiny objects shift the math; check the per-10k request line.
  • Invalidation has costs and lag — design cache-busting into asset URLs (hashed filenames) instead of relying on invalidations.
  • At very low traffic (~10 GB/month) the savings are pennies; do it for performance, not cost.

Skip this if

  • All traffic is unique-per-user dynamic content with no cacheable layer.
  • Users and origin sit in one region and volumes are small.
  • The egress you're fighting is internal (service-to-service) — that's VPC Endpoints / NAT consolidation territory, not CDN territory. At sustained 10+ TB/month, also ask AWS about CloudFront private pricing.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for CloudFront egress savings. Use the
AWS CLI with READ-ONLY credentials. Do not create, modify, or delete
anything — report findings and recommended (unapplied) fixes only.

1. Size the egress: Cost Explorer (if accessible) grouped by usage type
   for DataTransfer-Out-Bytes on S3, EC2, and ELB; otherwise CloudWatch
   BytesDownloaded on the biggest public buckets and NetworkOut on
   internet-facing instances/ALBs.
2. Identify what's being served: public S3 buckets / website-hosting
   buckets (aws s3api get-bucket-website, bucket policies), and
   internet-facing ALBs (aws elbv2 describe-load-balancers) serving
   static-ish content.
3. Existing CloudFront: aws cloudfront list-distributions — note
   origins already covered, price class, compression setting, and (if
   metrics available) cache hit ratio; a distribution with a hit ratio
   under ~60% is its own finding (TTLs/cache keys need tuning).
4. Model the move: direct S3/EC2 egress ~$0.09/GB (first tiers) vs
   CloudFront starting ~$0.085/GB (NA/EU) falling with volume, PLUS
   cache-hit traffic that never touches the origin. Estimate 30–50%
   savings on cacheable static content; note request fees (~$0.01/10k
   HTTPS). Flag content that will NOT benefit: fully personalized
   responses, same-region AWS-to-AWS traffic, tiny volumes.

Report: egress inventory (source | GB/mo | $/mo), candidates for a new
distribution or origin migration with modeled savings, tuning items on
existing distributions (price class, compression, TTLs), and rollout
steps. Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The CloudFront Egress Discounts walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Private Pricing

AWS's worst-kept secret: at 10+ TB/month of CDN egress you can negotiate custom CloudFront rates — typically 20–40% below the public price list — but only if you ask. AWS will never bring it up first.