A learning platform was paying $9,000 to $10,000 a month in data transfer. Storage was a few hundred dollars. Course videos streamed straight from Amazon S3 to users, mostly in Africa, through presigned URLs. Playback was already acceptable. The brief was cost.
The textbook fix showed up immediately: put CloudFront in front of the bucket, cache at the edge, and replace presigned URLs with signed cookies. That design is what conference talks recommend, and on a diagram it looks finished. It would have made this bill worse.
The comparison below uses on-demand rates that reproduce the benchmark: $0.154/GB out of af-south-1, $0.090/GB out of eu-west-1, and $0.110/GB for CloudFront's Africa and Middle East edge tier. AWS bills these in binary gigabytes, so 10 TB is 10,240 GB. Confirm the live rates on the S3 and CloudFront pricing pages before you reuse the totals.
The bill was the bytes leaving the region
Storage is a line you can see. Transfer is the line that scales with every student who presses play. Where that byte leaves AWS sets the price, and the platform's audience made the expensive region the obvious place to store the files. Cape Town is close to the viewers. It is also one of the more expensive regions for data transfer out to the internet.
10 TB is the unit used to compare designs. It is not the client's volume. Several times that left the bucket each month, which is how transfer reached five figures while the objects themselves stayed cheap. The gap between options grows with every extra 10 TB. The first 100 GB of internet egress each month is free across AWS, and CloudFront's pay-as-you-go free tier includes 1 TB of transfer. On a bill this size those allowances do not change which option wins.
Three pay-as-you-go options
| Option | Path | Cost of 10 TB |
|---|---|---|
| A | S3 direct, bucket in af-south-1 (Cape Town) | $1,576 |
| B | CloudFront, viewers on South African edges, origin in eu-west-1 | $1,126+ |
| C | S3 direct, bucket in eu-west-1 (Ireland) | $921 |
Option B is the one everyone reaches for. Transfer from an S3 origin to CloudFront is free, including on a cache miss, so the $1,126 is the edge charge for bytes delivered to viewers. The plus sign is HTTPS requests. CloudFront bills those on top of gigabytes, and a video player does not download a file in one GET.
| Option | Against the cheapest |
|---|---|
| C: S3 in Ireland | Baseline |
| B: CloudFront | +$205 (+22%), before requests |
| A: S3 in Cape Town | +$655 (+71%) |
CloudFront beats the bucket they already had, by about 29% on transfer. If the only meeting is A versus B, the CDN gets approved and the review ends. The cheaper change was moving the origin. Ireland undercuts the Africa edge rate by about $205 per 10 TB before a single request is counted, and the client delivers several of those units a month.
Serving African viewers from Ireland adds latency compared with Cape Town. For this platform the brief was money, and playback from Ireland stayed inside what they would accept. That is a measurement, not an assumption. Time to first byte and rebuffer rate, from the countries that actually watch, are the numbers that make the region move legitimate.
Why the best practice lost
Regional data-transfer prices are not a single AWS rate. A gigabyte that leaves Cape Town costs more than a gigabyte that leaves Ireland. Newer and opt-in regions often carry that premium. Moving the bucket changes the price of every byte without adding a service.
CloudFront prices the viewer, not the origin. African edge locations sit in a higher tier than Europe. The CDN does not average that away. A distribution with an Ireland origin and a South African viewer is billed at the Africa tier for the bytes that reach the viewer.
A cache hit does not reduce that charge. The viewer still receives the byte from the edge, and the edge rate still applies. A 50% miss rate (5 TB fetched from origin for 10 TB delivered) was in the model so the origin path was visible. Those 5 TB add no S3 data-transfer line, because S3 to CloudFront is not billed. A perfect hit ratio leaves option B at $1,126 against option C at $921. Caching pays the transfer bill when the edge rate is below the origin's internet rate, or when origin fetch itself is expensive. Here the edge was the expensive hop.
Requests are where video makes a CDN look cheap in a spreadsheet and costly in the invoice. Players ask for byte ranges, or for short segments, instead of one object. Each of those is a CloudFront request. Signed cookies do not change the per-gigabyte rate. They change the application: cookie domain, CORS, and a player that sends the cookie on every range. Presigned URLs already did access control. A region change keeps that mechanism. The endpoint in the signer moves. The failure modes do not.
What the move actually costs
The monthly saving starts after the bytes are in Ireland. Getting them there is a one-time inter-region transfer out of Cape Town, and that rate is its own line, priced well above a transfer inside Europe. Budget it from the pricing calculator against the monthly gap, not against zero. Storage was the small line, so the copy is finite. The $9,000 transfer bill recurs.
At the Cape Town rate, $9,000 to $10,000 is on the order of 55 to 65 TB a month. The same bytes out of Ireland land around $5,300 to $5,800. That is the pay-as-you-go saving: a smaller rate on the same traffic, one bucket, the same presigned URLs.
Flat-rate CloudFront is a different product
Pay-as-you-go is what the proposal was. CloudFront also sells flat-rate plans with no coverage charge: Pro at $15 a month, Business at $200, Premium from $1,000. Paid tiers include 50 TB of transfer. Premium steps up from there, including 75 TB and 750 million requests at $1,450. If a plan's allowances cover the workload, the monthly price can undercut both Cape Town and Ireland on dollars alone.
The allowance that video hits first is usually requests, not terabytes. Ten TB delivered in 1 MB ranges is about 10.5 million requests. That sits on Pro's 10 million request cap while using 10 TB of a 50 TB transfer allowance. The real volume, several times that, needs a tier chosen from the player's actual range size, not from the gigabytes. Business includes 125 million requests. Smaller segments exhaust it while transfer still looks comfortable.
Going past the allowance does not add a surprise line item. AWS can serve the traffic from fewer or more distant edges until you upgrade. For an audience in Africa, that adjustment gives back the latency the CDN was supposed to buy. A flat-rate plan is the right check before closing the ticket. It is not a reason to skip the pay-as-you-go comparison, because the two prices answer different questions.
Decide from the constraint, not the diagram
- Rank the objective. This one was cost, with playback that already worked. A latency SLO, or a requirement for WAF and edge auth, would have ranked CloudFront first and the spreadsheet second.
- Price the place data leaves, and the place viewers are. Those can be different bills.
- Include "move the data, add no service" as its own option. The cheapest design is often a location change.
- Ask what a cache hit actually avoids. If origin fetch is free and the edge rate is higher than origin internet egress, hit ratio will not save the transfer line.
- Count requests. Video, image tiles, and chatty APIs make the request allowance or the per-request charge the real number.
- Price pay-as-you-go and flat-rate as separate choices. Then scale both to 2x and 5x.
- Name the new failure mode. A region move has a one-time copy and a latency test. A CDN has a distribution, an auth change, and another bill line.
CloudFront is still the right system when performance leads, when viewers sit in a cheap edge tier, when you need WAF, geo-restriction, or signed cookies as the access model, or when a flat-rate allowance covers both bytes and requests. It was the wrong next step for this invoice.
Majority opinion is a starting point. The decision is the priced option that meets the constraint you actually have.