Amazon CloudFront is AWS's Content Delivery Network (CDN) service. A basic setup of CloudFront isn't hard to achieve, however, the pricing structure can be confusing and difficult to predict. This article is aimed at explaining the various aspects of AWS CloudFront pricing, and how to spend less money on it.

What Is Amazon CloudFront?

Amazon CloudFront is a global Content Delivery Network (CDN) service that safely delivers data, applications, videos, and APIs to users worldwide at high speed and with low latency. The service integrates seamlessly with the extensive infrastructure of Amazon Web Services (AWS), such as AWS Shield for DDoS mitigation, Amazon Simple Storage Service (Amazon S3), Amazon Route 53, and Elastic Load Balancing.

CloudFront operates via a network of data centers called edge locations that are located around the world. These edge locations help deliver content to users in the quickest way possible, thereby reducing latency and ensuring an efficient and reliable service.

CloudFront supports HTTP/2 and IPv6, offers field-level encryption, and integrates with AWS WAF (Web Application Firewall), AWS Shield, and AWS Certificate Manager. These features allow developers to create and manage content delivery efficiently and easily.

How does Amazon CloudFront deliver content?

Amazon CloudFront delivers content through its globally spread network of edge locations. When an end-user makes a request for content that is being served through CloudFront, the request is automatically routed to the edge location that can best serve the user's request. This is typically the edge location that provides the lowest latency.

The process by which CloudFront delivers content to the end-user can be broken down into a series of steps. Initially, when the end-user makes a request for content (like an image or a video), CloudFront routes the request to the edge location that can best serve the user's request. This is decided based on the proximity of the edge locations to the user, with the nearest one usually being chosen.

If the requested content is already in the edge location (cached from a previous request), CloudFront delivers the content directly to the user. If the requested content is not in the edge location, CloudFront forwards the request to the origin server (which can be an Amazon S3 bucket, an HTTP server, or a MediaPackage channel). The origin server then sends the content back to the CloudFront edge location, which in turn delivers the content to the end-user.

Once the content has been fetched from the origin server, CloudFront caches the content at the edge location, making it readily available for any subsequent requests. This is done so that for any future requests for the same content, CloudFront does not need to fetch the content from the origin server again. Instead, it can deliver the content directly from the edge location, reducing latency and improving the user's experience.

The time for which the content stays in the cache of the edge location is controlled by the cache control headers or by the CloudFront caching settings. Once the content is removed from the cache, any future request for the content would again need to be fetched from the origin server.

---

Stop copying cloud solutions, start understanding them. Join over 3600 devs, tech leads, and experts learning how to architect cloud solutions, not pass exams, with the Simple AWS newsletter.

---

How much does CloudFront cost?

Is CloudFront expensive? Not really. CloudFront can get expensive, but it's nearly always less expensive than delivering the same content without using CloudFront. The primary factors that contribute to CloudFront costs are the amount of data transferred out to the internet and the number of HTTP or HTTPS requests made.

To give a basic understanding of CloudFront's pricing structure, the costs are divided into three components:

• Data Transfer Out to Internet: This is the cost associated with the delivery of content from CloudFront to your users. The cost depends on the region from which the content is being served and the amount of data transferred.

• HTTP/HTTPS Requests: CloudFront also charges for the number of requests made by your users. The charges differ based on the type of request (HTTP or HTTPS) and the region from which the requests are served.

• Data Transfer Out to Origin: If your origin server is not an AWS service, CloudFront will charge for the data transferred from the CloudFront edge location back to your origin server.

Keep in mind the first 1 TB of data transfer out per month and the first 10,000,000 HTTP or HTTPS Requests per month are free.

CloudFront Price Classes

Pricing varies by geographic region, so the location of your users also impacts your costs. The global nature of CloudFront’s network of edge locations allows the service to maintain high availability and performance, but data transfer rates differ based on whether content is being delivered from the United States, Europe, Asia, Australia, South America, or Africa. Note that this doesn't exactly depend on where the users are actually located, but rather on the edge location from which the content is served. For a better user experience, content should be served from edge locations near the user, but this can increase price. Additionally, if you are using an AWS origin, data transferred from this AWS origin to CloudFront edge locations will be free.

With CloudFront, you don't get to choose directly which regions to enable or not. Instead, you choose between three different price classes, and the regions that are enabled depend on that.

These are the regions enabled for each price class:

CloudFront Price Class 100 will be the cheapest, including only North America, Europe and Israel. Price Class 200 includes all regions except South America and Australia and New Zealand, which are the most expensive. Price Class All includes all regions.

Keep in mind that the price doesn't depend on the Price Class that you choose. It depends on what regions are used to serve the traffic. If you select Price Class All and have 10 users from South America and 10 from the US, you'll be paying more than if you selected Price Class 100. However, with Price Class 100 the users in South America would be served from the nearest region that's enabled, North America in this case, and would have a worse user experience.

CloudFront Pricing Example

To illustrate how AWS CloudFront pricing works, let’s consider an example. Suppose you have an application hosted in the US East (N. Virginia) region, and you have users all around the world. You use CloudFront to deliver 150 GB of data and handle 300,000 HTTPS requests in one month. Keep in mind that the requests are HTTPS, which are priced slightly higher than HTTP requests.

Keep in mind the first 1 TB of data transfer out per month and the first 10,000,000 HTTP or HTTPS Requests per month are free. We're going to exclude these from our calculations, to better understand how CloudFront is priced beyond the free tier.

For the US, Canada, Mexico, Europe and Israel, AWS charges $0.085 per GB for the first 10 TB / month of data transfer out, and $0.0100 per 10,000 HTTPS request. So, your data transfer cost would be 150 GB x $0.085/GB = $12.75. The HTTPS requests cost would be 300,000 x $0.0100/10,000 = $0.30. So, the total cost for CloudFront would be $13.05.

For South America, the rates differ slightly. For the first 10 TB per month, AWS charges $0.110 per GB for data transfer out, and the HTTPS requests are charged at $0.0220 per 10,000 HTTPS requests. So, suppose we deliver an additional 50 GB of data in South America, with 100,000 HTTPS requests. Your data transfer costs would be 50 GB x $0.110/GB = $5.5, and the HTTPS requests costs would be 100,000 x $0.0220/10,000 = $0.22, totaling $5.72 for South America. The total cost for all of our regions would be $18.77.

This is a simplified example, and actual costs can be affected by other factors such as the price for invalidation requests (requests to remove an object from CloudFront cache before the set expiration time), dedicated IP custom SSL, and field-level encryption requests.

You can view the entire calculation in this AWS Pricing Calculator estimate.

Additional Costs for CloudFront Integrations

While CloudFront itself is cost-effective, integrating it with other AWS services may result in additional charges for bandwidth usage. For instance, if you store your files in an Amazon S3 bucket, you'll incur S3 storage costs. Similarly, if you're using AWS Shield for DDoS protection or Amazon Route 53 for DNS, you'll be billed for those services as well.

Remember that while CloudFront does charge for data transfer to the viewer, it does not charge for data transfer from origin servers like Amazon S3, Elastic Load Balancing, or EC2 to CloudFront. You also won’t be charged for viewer requests to your website.

Amazon CloudFront Price Tips and Tricks

There are several strategies you can employ to optimize your CloudFront costs. Here are a few tips and tricks:

• Use the AWS Free Tier: The first 1 TB of data transfer out per month and the first 10,000,000 HTTP or HTTPS Requests per month are free, forever. This means even accounts older than 12 months enjoy this free tier.

• Price Classes: You can reduce the cost of delivery by choosing a price class for your CloudFront distribution that includes only the regions that your main users are in. This allows you to exclude more expensive regions where you may not have users. If a user requests the content from a region you haven't configured in CloudFront, they'll still be able to get the content, just with increased latency. For example, if you only configure North America, a user in South America will have their request sent to the edge locations in Mexico.

• Caching Optimization: Fine-tune your CloudFront cache settings to maximize the caching duration (TTL) of your content at edge locations. This reduces the need to fetch data from the origin, which can significantly cut down data transfer costs.

• Data Compression: CloudFront can automatically compress certain files at edge locations. This can reduce the size of data that CloudFront needs to transfer, which in turn can reduce your cost.

• CloudFront Savings Bundle: For those with predictable high-volume traffic patterns, committing to a certain level of usage by purchasing a CloudFront Savings Bundle will result in a reduction of up to 30% of your CloudFront costs.

Amazon CloudFront Use Cases

There are several common use cases for Amazon CloudFront, including static asset caching and live streaming. These use cases highlight how businesses leverage the service to enhance their operations and serve their users more effectively.

Static Asset Caching

CloudFront excels in delivering static web content like HTML, CSS, JavaScript, and image files. By storing this content closer to users, websites experience reduced load times and increased reliability. For instance, a global e-commerce company could use CloudFront to serve its product images and website stylesheets to customers around the world, ensuring fast load times and a smooth shopping experience.

Live Streaming

CloudFront is also used for streaming live events such as sports, gaming tournaments, and concerts. The AWS Elemental MediaPackage integrates seamlessly with CloudFront for a scalable and cost-effective live streaming solution. Content providers can deliver live video with low latency to a global audience, providing an excellent viewing experience.

---

Stop copying cloud solutions, start understanding them. Join over 3600 devs, tech leads, and experts learning how to architect cloud solutions, not pass exams, with the Simple AWS newsletter.

---

Amazon S3 Storage Classes

Depending on your use case, you can choose from a range of Amazon S3 storage classes, each with different pricing, availability, and durability characteristics.

Amazon S3 Standard

Amazon S3 Standard is the default storage class and is designed for frequently accessed data. It offers high durability, throughput, and low-latency, supporting a wide variety of use cases including cloud applications, content distribution, or backup and restore operations.

Amazon S3 Standard-Infrequent Access

S3 Standard-IA is meant for data that is accessed less frequently, but still requires rapid access when needed. It offers a cheaper storage price per GB than S3 Standard, while still providing the same high durability and throughput. This class is suitable for long-term backups and secondary storage.

S3 Glacier and Glacier Deep Archive

S3 Glacier and Glacier Deep Archive classes are designed for archiving data. S3 Glacier offers cost-effective storage for data archiving and backup, and data is accessible in timeframes that range from minutes to hours, depending on the configuration. S3 Glacier Deep Archive is the lowest-cost storage class and supports retrieval within 12 hours, ideal for archiving data that is rarely accessed.

Amazon S3 Use Cases

The availability, durability and ease of use of Amazon S3 make it an excellent choice for a wide arrange of use cases and applications.

Building a Data Lake with S3

With Amazon S3, you can build a highly scalable and secure data lake capable of storing exabytes of data. S3 supports all types of data, from structured files such as CSVs to unstructured social media data, computer logs, or IoT device-generated data. It can act as a hub for big data analytics, machine learning, and real-time business analytics. Furthermore, it integrates seamlessly with AWS services like Athena for querying data, Quicksight for visualization, and Redshift Spectrum for exabyte-scale data analysis.

Backing Up and Restoring Critical Data in S3

Amazon S3's availability and resilience make it ideal for backing up and restoring critical data. Its versioning feature allows you to preserve, retrieve, and restore every past version of every object, adding an extra layer of protection against user errors, system failures, or malicious acts. With cross-region replication (XRR) you can automate the replication of data across different geographical regions, ensuring your data is available and protected in the case of local or regional failures.

In addition, Amazon S3’s lifecycle policies can be utilized to automate the migration of data between tiers, reducing costs, and enhancing efficiency in backup operations. Its compatibility with several AWS and third-party backup solutions makes it even better, enabling you to implement custom backup strategies without a huge engineering effort.

Archiving Data in S3 at the Lowest Cost

Amazon S3 offers highly durable and cost-effective solutions for archiving data. With S3 Glacier and S3 Glacier Deep Archive storage classes, you can preserve data for the long term at a fraction of the cost of on-premises solutions. S3 Glacier is ideal for data that needs retrieval within minutes to hours, while S3 Glacier Deep Archive is the lowest-cost storage class suitable for archiving data that's accessed once or twice in a year and can tolerate a retrieval time of 12 hours.

S3's fine-tuned access policies and automatic data lifecycle policies ensure that your data remains secure and compliant, regardless of how long it's archived.

Running Cloud-Native Applications with S3

Amazon S3 provides highly durable, scalable, and accessible storage for cloud-native applications. Developers can use S3's features and integrations with AWS services to build sophisticated applications capable of handling vast amounts of data and millions of users.

From storing user-generated content, like photos and videos, to serving static web content directly from S3, the service offers robust functionality. In addition, S3 events can trigger AWS Lambda functions for serverless computing, enabling you to build reactive, efficient applications.

Security in Amazon S3

Securing your data is a top priority when using Amazon S3 storage. The service provides a multitude of configurable security options to ensure your data remains private, and access is controlled.

Access Control in S3

Identity and Access Management (IAM)

AWS IAM allows you to manage access to AWS services and resources securely. IAM users or roles can be given permissions to access specific S3 buckets or objects using IAM policies. By applying least privilege access, where you grant only necessary permissions, you can reduce the risk of unauthorized access.

S3 Bucket Policies and ACLs

Bucket policies are used to define granular, bucket-level permissions. For example, you can set a policy that allows public read access to your bucket or restricts access to specific IP addresses.

Access Control Lists (ACLs), on the other hand, can be used to manage permissions at the individual object level, allowing more fine-grained access control.

Block Public Access to S3

S3 provides the option to block public access to your buckets. With this feature, you can set up access rules that override any other access policies, ensuring that your data remains private unless explicitly shared.

Encryption in S3

S3 Server-Side Encryption

Amazon S3 provides server-side encryption where data is encrypted before it's written to the disk. There are three server-side encryption options:

1. S3 Managed Keys (SSE-S3): Amazon handles key management and key protection for you.

2. AWS Key Management Service (SSE-KMS): This offers an added layer of security and audit trail for your key usage.

3. Customer-Provided Keys (SSE-C): You manage the encryption keys.

S3 Client-Side Encryption

In client-side encryption, data is encrypted on the client-side before it's transferred to S3. You have complete control and responsibility over encryption keys in this case.

Data Protection in S3

S3 Object Versioning

Versioning allows you to preserve, retrieve, and restore every version of every object in your bucket. This feature protects against both unintended user actions and application failures.

Amazon S3 Lifecycle

Lifecycle policies can be used to automate moving your objects between different storage classes at defined times in the object's lifecycle. For example, moving an object from S3 Standard to S3 Glacier after 30 days.

Security Monitoring and Compliance for S3

AWS CloudTrail

AWS CloudTrail logs, monitors and retains account activity related to actions across your AWS infrastructure. This can be useful for auditing and review of S3 bucket accesses and changes.

AWS Trusted Advisor

Trusted Advisor provides insights regarding AWS resources following best practices for performance, security, and cost optimization.

Amazon S3 Replication

One of the critical services Amazon S3 offers is data replication. It is a crucial aspect of ensuring data availability and protection against regional disruptions. Amazon S3 provides different types of replication services to meet various data management requirements.

What is Amazon S3 Replication?

Amazon S3 replication is an automatic, asynchronous process that makes an exact copy of your objects to a destination bucket in the AWS region of your choice. The replicated objects retain the metadata and permissions of the source objects.

Types of Amazon S3 Replication

Amazon S3 offers several types of replication services:

S3 Cross-Region Replication (CRR)

S3 Cross-Region Replication enables automatic, asynchronous copying of objects across buckets in different AWS regions. CRR is used to reduce latency, comply with regulatory requirements, and provide more robust data protection.

S3 Same-Region Replication (SRR)

Similar to CRR, S3 Same-Region Replication (SRR) automatically replicates objects within the same AWS region. SRR is useful for data sovereignty rules compliance, maintaining operational replica within the same region, or for security reasons.

S3 Replication Time Control (RTC)

S3 Replication Time Control (RTC) is designed for workloads that require predictable replication times backed by a Service Level Agreement (SLA). S3 RTC offers replication in less than 15 minutes for 99.99% of objects.

S3 Replication to Multiple Destinations

S3 also supports replicating data to multiple destination buckets. This feature is useful when you need to set up complex, resource-sharing structures between various departments or separate backup strategies.

Setting Up Replication in Amazon S3

To set up replication, you must use an IAM role that grants Amazon S3 the required permissions to replicate objects on your behalf. Then, create a replication rule in the AWS Management Console, specifying the source and destination buckets and the IAM role.

After setting up replication, you can monitor the process using S3 Replication metrics, events, and S3 Replication Time Control (S3 RTC). You can access these metrics through the Amazon S3 console or Amazon CloudWatch.

Understanding S3 Replication Costs

Replicating objects with Amazon S3 incurs costs for storing the replicated copy and for transferring data to another AWS region (for CRR). Additionally, there might be costs associated with requests, such as PUT, LIST, and GET, made against your buckets.

Conclusion

With its robust durability, security features, and a wide range of storage classes, Amazon S3 can handle a variety of use cases, from primary application storage to long-term archival. By understanding the mechanisms underpinning S3, you can leverage its full potential to drive cost efficiency and streamline your data storage and access workflows.

---

Stop copying cloud solutions, start understanding them. Join over 3600 devs, tech leads, and experts learning how to architect cloud solutions, not pass exams, with the Simple AWS newsletter.

• Real scenarios and solutions

• The why behind the solutions

• Best practices to improve them

Subscribe for free

If you'd like to know more about me, you can find me on LinkedIn or at www.guilleojeda.com