Direct answer: for US regions, 1TB = 1,000GB and public egress + GET/HTTPS requests only, 2026 monthly costs for S3 direct vs CloudFront are roughly: 1TB/1M requests, S3 81.40, CloudFront 86; 10TB/10M requests, S3 895, CloudFront 860; 10TB/100M requests, S3 931, CloudFront 950; 100TB/100M requests, S3 7,831, CloudFront 7,150; 100TB/1B requests, S3 8,191, CloudFront 8,050. CloudFront’s 0.085/GB first tier is 0.005/GB below S3 direct 0.09/GB, but every million requests costs 0.60 more; the break-even is about 8,333 requests/GB (about 120KB average object). Smaller objects/higher request rates can favor S3 direct; larger objects/higher cache hit rates favor CloudFront.
This article compares “S3 direct public download” with “CloudFront origin fetch from S3 and delivery to users”; it does not repeat multi-CDN selection (see the CDN cost page) or the object-storage/egress overview. It targets installers, video, images, model weights and SaaS file distribution. Data cut-off: 5 November 2026; prices are AWS US official pricing pages and the Price List API (AWSDataTransfer, AmazonCloudFront, AmazonS3), in USD, excluding tax; the TCO is an editorial calculation, not an AWS quote. AWS bills in GB; 1TB = 1,000GB is an editorial convention.
S3 direct: first 100GB/month public egress free, then 0.09/GB first 10TB, 0.085/0.07/0.05; GET about 0.40/million. CloudFront: US egress 0.085/GB first 10TB, 0.080/0.060/0.040; HTTPS requests 1.00/million; S3 origin fetch avoids S3 egress. CloudFront saves 0.005/GB but costs 0.60/million more in requests, so the break-even is about 8,333 requests/GB (about 120KB/object).
Two paths: S3 direct vs CloudFront origin fetch
S3 direct: users GET objects directly from S3; S3 charges public egress + GET requests; suitable for large files, low request counts and simple downloads without edge cache/WAF/signing. CloudFront: users hit the edge; a cache hit returns directly, a miss fetches from S3, and S3→CloudFront origin fetch does not incur S3 public egress; CloudFront charges US egress + HTTPS requests; custom origins also incur 0.02/GB origin fetch. CloudFront’s first bandwidth tier 0.085/GB is below S3 0.09/GB, but its request price 1.00/million is above S3 GET about 0.40/million; the winner depends on object size/request count and cache hit rate.
| Path | Bandwidth | Requests | Origin | Best fit |
|---|---|---|---|---|
| S3 direct | 100GB/month free; 0.09/GB first 10TB | GET about 0.40/million | None | Large files/low requests/simple downloads |
| CloudFront | 0.085/GB first 10TB; 0.080/0.060/0.040 | HTTPS 1.00/million; HTTP 0.75/million | S3 origin avoids S3 egress; custom origin 0.02/GB | Global delivery/cache/edge security |
Sources: AWS S3 Pricing (Data transfer, GET), AWS CloudFront Pricing and the AWS Price List API (AWSDataTransfer, AmazonCloudFront, AmazonS3). Accessed 5 November 2026; USD, excluding tax; CloudFront’s 0.085/0.080/0.060/0.040 are US egress tiers; S3’s 100GB free is aggregated across services/regions (except China/GovCloud); custom-origin fetch is 0.02/GB.
The 2026 official rates: per GB egress, per million requests
S3: public egress 100GB/month free, then 0.09/GB first 10TB, 0.085 next 40TB, 0.07 next 100TB, 0.05 >150TB; GET/other about 0.0004/1,000 (0.40/million). CloudFront US: egress 0.085/GB first 10TB, 0.080 next 40TB, 0.060 next 100TB, 0.040 next 350TB, 0.030 next 524TB; HTTPS 0.0100/10,000 (1.00/million), HTTP 0.0075/10,000 (0.75/million); S3 origin fetch avoids S3 egress; custom origin 0.02/GB.
| Item | AWS S3 direct | CloudFront (US) |
|---|---|---|
| Egress first 10TB | 0.09/GB (after 100GB free) | 0.085/GB |
| Egress next 40TB | 0.085/GB | 0.080/GB |
| Egress next 100TB | 0.07/GB | 0.060/GB |
| Higher egress tiers | 0.05/GB >150TB | 0.040/GB 350TB; 0.030/524TB |
| Requests | GET about 0.40/million | HTTPS 1.00/million; HTTP 0.75/million |
| Origin | None | S3 origin free of S3 egress; custom origin 0.02/GB |
Sources: AWS S3 Pricing, AWS CloudFront Pricing and the AWS Price List API (AWSDataTransfer/AmazonCloudFront/AmazonS3, us-east-1). Accessed 5 November 2026; USD, excluding tax; S3’s 100GB free is aggregated across services/regions; CloudFront requests are HTTPS 0.0100/10,000 and HTTP 0.0075/10,000; egress >500TB is sales-led per AWS.
1TB / 10TB / 100TB: egress + request TCO
At 1TB = 1,000GB, HTTPS requests and public egress + requests only: 1TB/1M, S3 81.40, CloudFront 86; 10TB/10M, S3 895, CloudFront 860; 10TB/100M, S3 931, CloudFront 950; 100TB/100M, S3 7,831, CloudFront 7,150; 100TB/1B, S3 8,191, CloudFront 8,050. At 10TB/10M CloudFront is slightly lower; at 10TB/100M S3 takes over; at 100TB/100M CloudFront is about 9% lower; at 100TB/1B they are close, with CloudFront slightly lower.
| Monthly traffic/requests | S3 direct | CloudFront | Difference | Lowest |
|---|---|---|---|---|
| 1TB / 1M | 81.40 | 86.00 | +4.60 | S3 |
| 10TB / 10M | 895.00 | 860.00 | −35.00 | CloudFront |
| 10TB / 100M | 931.00 | 950.00 | +19.00 | S3 |
| 100TB / 100M | 7,831.00 | 7,150.00 | −681.00 | CloudFront |
| 100TB / 1B | 8,191.00 | 8,050.00 | −141.00 | CloudFront |
Editorial calculation, not a quote. S3 = egress (1TB subtracts 100GB free; 0.09/0.085/0.07) + GET (0.40/million); CloudFront = US egress (0.085/0.080/0.060) + HTTPS (1.00/million). Excludes tax, storage, other S3 request types, CloudFront custom-origin fetch, cache-miss extra requests, WAF/logs/signing, support and migration; 1TB = 1,000GB; CloudFront Free Tier is not included.
Break-even: what object size/request volume justifies CloudFront?
CloudFront saves 0.005/GB but costs 0.60/million more in requests; break-even = 0.005×1,000,000/0.60 = 8,333 requests/GB, or about a 120KB average object. Above 120KB (fewer requests/GB), CloudFront’s bandwidth saving wins; below 120KB (more requests/GB), S3 direct’s lower request fee wins. At 10TB the break-even is about 83.33M requests; at 100TB about 833M. Higher cache hit rate reduces origin fetch but not viewer request fees; S3 origin fetch is free, custom origin 0.02/GB.
| Average object | Requests/GB | CloudFront cheaper? | Why |
|---|---|---|---|
| 1MB | 1,000 | Yes | Few requests; 0.005/GB saving wins |
| 500KB | 2,000 | Yes | Below 8,333 requests/GB |
| 120KB | About 8,333 | Tie | Bandwidth saving ≈ request difference |
| 50KB | 20,000 | No | 0.60/million request fee exceeds bandwidth saving |
| 10KB | 100,000 | No | Request fee dominates; S3 direct lower |
Editorial calculation, not a quote. Break-even uses S3 0.09/GB, CloudFront 0.085/GB, S3 GET 0.40/million and CloudFront HTTPS 1.00/million; excludes cache hit/origin, storage, tax, WAF/logs/signing and support; object size is the inverse of requests/GB.
Cache hits, origin and hidden costs
CloudFront’s cache hit rate determines origin fetch and origin load, but viewer request fees still apply per request; S3→CloudFront origin fetch avoids S3 public egress, custom origin fetch is 0.02/GB. S3 direct has no edge cache/WAF/signed-URL layer, but every download hits S3 and GET requests are 0.40/million. CloudFront also has WAF, real-time logs, field-level encryption, signed requests and Origin Shield requests at 0.0075/10,000; S3 has storage, other request types and Transfer Acceleration/MRAP. Both exclude tax, support and migration. At low cache hit rates, CloudFront’s bandwidth saving can be offset by origin/request costs.
| Item | S3 direct | CloudFront |
|---|---|---|
| Cache | No edge cache | Edge cache; hits avoid origin |
| Origin | None | S3 origin avoids S3 egress; custom origin 0.02/GB |
| Request add-ons | GET 0.40/million | HTTPS 1.00/million; HTTP 0.75/million |
| Security/logs | IAM/signed URLs; logs separate | WAF/logs/field-level encryption/signing separate |
| Acceleration/multi-region | Transfer Acceleration/MRAP separate | Origin Shield 0.0075/10,000 requests |
| Tax/support/migration | Excluded | Excluded |
Sources: AWS S3 Pricing, AWS CloudFront Pricing and the AWS Price List API (accessed 5 November 2026). USD, excluding tax; “separate” means confirm on the product/contract page and is not guessed here; cache hit/origin volume is not modelled and needs real access logs.
Which option fits which scenario?
Large files (installers, video, models, images) with low requests/GB: CloudFront; small objects/high-frequency API/short links/icons with high requests/GB: S3 direct; global edge/WAF/signing/logs/cache: CloudFront; simple download/budget-sensitive/low requests: S3 direct. Use the real object size against the 8,333 requests/GB break-even, then adjust for cache hit/origin; do not look only at 0.085 vs 0.09 bandwidth.
| Scenario | First choice | Why | Watch |
|---|---|---|---|
| Large files/low requests | CloudFront | 0.085/GB + low requests/GB | Cache hit/origin |
| Small objects/high requests | S3 direct | GET 0.40/million below CF 1.00/million | No edge cache |
| Global delivery/security | CloudFront | Edge, WAF, signing, logs | Add-ons separate |
| Simple download/low volume | S3 direct | 100GB free, no extra layer | Bandwidth 0.09/GB |
| High cache hit | CloudFront | Less origin, lower origin load | Viewer requests still billed |
| Custom origin | Compare origin fetch | CF origin 0.02/GB | S3 origin avoids S3 egress |
Sources: AWS S3/CloudFront official pricing pages (accessed 5 November 2026). This is an editorial decision matrix, not AWS advice; actual cache hit, latency, throughput, WAF effect and support response were not tested.
What should procurement and acceptance specify?
At least eight things: monthly egress TB, requests/average object, cache hit/origin, S3 storage/request types, CloudFront features (WAF/logs/signing), custom origin, acceleration/multi-region and tax/support/migration. Use a 2–4 week POC with real access logs and record hit rate, origin fetch, P95, requests, egress and the bill; do not compare only per GB.
- Egress/requests: monthly TB, request count, average object size; calculate requests/GB.
- Cache: hit rate, origin volume, TTL/invalidation; viewer requests still bill.
- S3: storage class, GET/other requests, signed URLs, acceleration/MRAP.
- CloudFront: WAF, logs, field-level encryption, Origin Shield, signing.
- Custom origin: non-S3 origin fetch 0.02/GB; origin egress/bandwidth.
- Region: US pricing; other regions/edge prices differ.
- Contract/support: commitments, support, tax, migration.
- POC: 2–4 weeks of real logs; record hit, origin, P95, requests, egress and the bill.
FAQ
10TB/10M requests: which is cheaper?
S3 895, CloudFront 860; CloudFront is slightly lower. Average object 1MB, requests/GB low, so the 0.005/GB bandwidth saving wins.
10TB/100M requests: which is cheaper?
S3 931, CloudFront 950; S3 is slightly lower. Requests/GB is high, so CloudFront’s extra 0.60/million request fee exceeds the bandwidth saving.
100TB/100M requests: which is cheaper?
S3 7,831, CloudFront 7,150; CloudFront is about 9% lower. Large traffic with low requests/GB amplifies the bandwidth saving.
100TB/1B requests: which is cheaper?
S3 8,191, CloudFront 8,050; CloudFront is slightly lower. This is near the break-even (about 833M requests); recalculate with real object size and cache hit.
Where does the break-even come from?
CloudFront saves 0.005/GB but costs 0.60/million more; 0.005×1,000,000/0.60=8,333 requests/GB, about 120KB/object. Below 120KB, S3 direct is cheaper.
Does a high cache hit rate always make CloudFront cheaper?
No. A cache hit reduces origin fetch/source load, but viewer request fees still apply per request; when requests/GB is high, S3 direct can still be lower.
Is S3 origin fetch charged?
S3→CloudFront origin fetch does not incur S3 public egress; custom origin fetch is 0.02/GB. The origin’s own egress/bandwidth is separate.
What other hidden costs exist?
WAF/logs/field-level encryption/signing, Origin Shield requests, S3 other requests/acceleration/MRAP, custom-origin fetch, tax, support and migration. This article counts egress + GET/HTTPS only.
Research method and limitations
This article separates “official facts” from “editorial modelling”: S3 egress/GET, CloudFront egress/HTTPS/origin prices come from AWS official pricing pages and the Price List API (AWSDataTransfer, AmazonCloudFront, AmazonS3, US); the 1/10/100TB TCO is arithmetic under 1TB = 1,000GB and public egress + GET/HTTPS only, not an AWS quote. It does not compare actual cache hit, latency, throughput, WAF effect or support response.
Eight limitations: (1) only US public prices are used, excluding tax, discounts, private pricing and commitments; (2) 1TB = 1,000GB is editorial, while AWS bills GB and may differ slightly; (3) only egress + GET/HTTPS are counted, excluding storage, other request types, WAF/logs/signing, Origin Shield, acceleration/MRAP, support and migration; (4) cache hit/origin volume is not modelled and depends on TTL/access distribution; (5) CloudFront Free Tier is not included; (6) only S3 vs CloudFront is compared, not multi-CDN; (7) actual cache hit, latency, throughput and WAF were not tested; (8) custom-origin/regional prices can change the result. Treat this as a unit-alignment template and replace assumptions with a 2–4 week real-access-log POC.
Sources and basis
- AWS, S3 Pricing (Data transfer, Requests): aws.amazon.com/s3/pricing. Public egress 100GB/month free; 0.09/GB first 10TB, 0.085/0.07/0.05; GET about 0.40/million. Accessed 5 November 2026.
- AWS Price List API, AWSDataTransfer (current): pricing.us-east-1.amazonaws.com/.../AWSDataTransfer/current/index.json. us-east-1 AWS Outbound tiers. Accessed 5 November 2026.
- AWS, CloudFront Pricing: aws.amazon.com/cloudfront/pricing. US egress 0.085/0.080/0.060/0.040/0.030; HTTPS 1.00/million, HTTP 0.75/million; S3 origin avoids S3 egress; custom origin 0.02/GB. Accessed 5 November 2026.
- AWS Price List API, AmazonCloudFront (current): pricing.us-east-1.amazonaws.com/.../AmazonCloudFront/current/index.json. US DataTransfer-Out-Bytes and US-Requests-Tier2-HTTPS prices. Accessed 5 November 2026.
Data cut-off 5 November 2026; prices are public list prices excluding tax; all models are editorial calculations. This is not procurement advice.