CloudFront cuts heavy egress bills for two reasons. First, transfer from an S3 origin to CloudFront costs nothing, so fronting your origin removes a charge you would otherwise pay on direct delivery. Second, CloudFront data transfer out tiers down with volume and can be lowered further with a CloudFront Security Savings Bundle or private pricing commitment, so at scale the per GB rate beats direct S3 or EC2 egress, which starts at roughly 0.09 dollars per GB in the US tiers. The catch is request fees and the need to cache effectively, so CloudFront pays off most when traffic is high volume and at least partly cacheable.
Here is the math and where it turns.
How does direct egress price compared to CloudFront?
Direct internet egress from S3 or EC2 in the US regions starts at about 0.09 dollars per GB for the first tier and steps down as monthly volume grows, reaching roughly 0.05 dollars per GB at petabyte scale. CloudFront data transfer out starts a little lower, around 0.085 dollars per GB in the first tier for North America and Europe, and tiers down more aggressively at high volume, with committed bundles taking it lower still. Both have a free allowance each month under the AWS Free Tier.
On the per GB rate alone the two look close at low volume. The gap opens at scale and, more importantly, when you account for the origin transfer charge that CloudFront removes.
Why is fronting an origin with CloudFront cheaper?
Serving directly from S3 means every byte to a user is billed as S3 internet egress. Put CloudFront in front and two things change. The user facing bytes are billed at CloudFront rates, and the origin fetch, the transfer from S3 to CloudFront, is free. With effective caching, only cache misses ever reach the origin, so a high cache hit ratio means you fetch a small fraction of your delivered volume from S3, and you pay nothing for those fetches.
| Path | User facing transfer | Origin to edge transfer | Request fees |
|---|---|---|---|
| Direct from S3 | about 0.09 dollars per GB, tiering down | Not applicable | S3 request costs only |
| S3 behind CloudFront | about 0.085 dollars per GB, tiering down faster, lower with a bundle | Free | CloudFront request fees per 10k |
This is why a high egress, cacheable workload almost always belongs behind CloudFront: you lower the delivery rate and delete the origin charge in one move.
What about the request fees and caching?
CloudFront charges per request, on the order of fractions of a cent per 10,000 HTTPS requests, varying by region. For large object delivery, video segments, software downloads, big images, request fees are negligible against transfer. For tiny objects served at very high request rates with low cache hit ratios, request fees and origin fetches grow, and the advantage narrows.
The lever you control is the cache hit ratio. The more you serve from the edge, the fewer origin fetches and the lower the effective cost. Tune cache keys, set sensible time to live values, and consider Origin Shield for a consolidating cache layer when many edge locations would otherwise each fetch the same object. Origin Shield adds a request fee, so use it where it reduces origin load more than it costs.
How much can heavy egress save with CloudFront?
A European SaaS company streamed software updates and media directly from S3, paying internet egress on every byte at petabyte monthly scale. Roughly 85 percent of the content was identical across users and highly cacheable. Moving delivery behind CloudFront billed user facing bytes at the lower tiered CloudFront rate, made the origin fetches free, and a high cache hit ratio meant only a small fraction of volume touched S3 at all. A CloudFront Security Savings Bundle locked a committed volume at a lower rate for the predictable base. The combined effect cut the delivery line by roughly 40 percent against the direct S3 baseline. Figures are verified against billing data and anonimised.
The saving scales with cacheability and volume. The more your content repeats across users and the more you deliver, the larger the gap between direct egress and CloudFront.
When is CloudFront not the answer?
CloudFront does not help much for low volume traffic that stays inside the free tier, for entirely unique and uncacheable responses fetched once, or for purely internal or region to region transfer, which is a different pricing problem covered in data transfer costs on AWS explained. For genuinely heavy egress that crosses clouds, weigh the broader picture in egress fees across the four clouds. For commitment based delivery pricing, model a CloudFront bundle the same way you would any commitment, against a defensible forecast. The full estate view sits in the AWS cost optimization guide.
Frequently asked questions
Get the buyer side cloud cost playbook
We model your egress across direct transfer, CloudFront, and committed bundles, then redesign delivery so you pay the lowest defensible rate without hurting performance. It is the same discipline behind the 31 percent median reduction we see in the first 90 days, with zero provider commissions. Our guarantee: we reduce your cloud spend or we reimburse our service fee.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.