# Internet Traffic Served Directly from S3 or EC2 Instead of CloudFront Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/internet-traffic-served-directly-from-s3-or-ec2-instead-of-cloudfront Public websites, static assets, software downloads, media and APIs are often served straight from an S3 bucket, an EC2 instance or an internet-facing... By: PointFive Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) The short version Public websites, static assets, software downloads, media and APIs are often served straight from an S3 bucket, an EC2 instance or an internet-facing load balancer. PointFive Research Cloud cost research at PointFive AWS service [AWS CloudFront](https://www.pointfive.co/efficiency-hub/cloud-services/aws-cloudfront) Category [Networking](https://www.pointfive.co/efficiency-hub/service-category/networking) Reference CER-0350 Type Inefficient Architecture ## Explanation Why the waste happens and who it affects. Every byte then leaves AWS as regional data transfer out to the internet, billed by the origin service. Putting Amazon CloudFront in front of the same origin changes the billing: data transferred from AWS origins to CloudFront edge locations is free, and viewers are billed at CloudFront's own delivery rates, which include a monthly always-free allowance and volume tiers. The pattern usually starts with a bucket made public for a quick download link or an ALB exposed directly at launch, and is not revisited as traffic grows. It affects content-heavy and download-heavy workloads most, and the saving is largest when a high share of responses is cacheable, because CloudFront also stops repeat requests from reaching the origin. AWS Well-Architected (COST08-BP03) lists edge locations and CDNs as a way to reduce data transfer cost. ## Billing model The pricing dimensions that drive this cost. Origin internet egress S3, EC2 and ELB traffic to the internet is billed per GB at regional data transfer out rates, after 100 GB per month free across all AWS services Origin fetches to CloudFront Data transferred from AWS origins such as S3, EC2 and ELB to CloudFront edge locations is free of charge CloudFront data transfer out Billed per GB by viewer geography in volume tiers, with the first 1 TB per month free under the always-free tier CloudFront requests Billed per 10,000 HTTP or HTTPS requests by geography, with the first 10 million requests per month free Flat-rate plans Fixed monthly CloudFront plans with usage allowances and no overage charges, as an alternative to pay-as-you-go ## How to detect 4 checks to find it in your estate. - In Cost Explorer or the Cost and Usage Report, group S3, EC2 and ELB costs by usage type and look for large internet data transfer out lines (usage types containing DataTransfer-Out-Bytes) - Identify S3 buckets that serve public reads or use static website hosting, and check whether their download volume goes to the internet rather than through a CloudFront distribution - Find internet-facing ALBs and EC2 instances whose responses are mostly static or cacheable content such as images, scripts, installers or video segments - Compare the origin's monthly internet egress against CloudFront pay-as-you-go rates and flat-rate plan allowances for the same traffic profile ## How to fix 5 ways to remove the waste. - Create a CloudFront distribution with the S3 bucket, ALB or EC2 instance as origin, and point the public DNS name at the distribution - For S3 origins, use origin access control and a bucket policy scoped to the distribution so the bucket no longer needs to be public and viewers cannot bypass CloudFront - Set cache behaviors and TTLs so static and cacheable paths are served from edge caches, which also reduces origin requests and compute - Evaluate CloudFront flat-rate plans or the CloudFront Security Savings Bundle when traffic is predictable, and compare them with pay-as-you-go before committing - Keep in mind that uncacheable, highly personalized responses still generate a CloudFront request and delivery charge, so model the traffic mix before moving dynamic APIs ## Documentation Vendor references for pricing and configuration. - [Amazon CloudFront pay-as-you-go pricing aws.amazon.com](https://aws.amazon.com/cloudfront/pricing/pay-as-you-go/) - [Amazon CloudFront CDN pricing aws.amazon.com](https://aws.amazon.com/cloudfront/pricing/) - [Amazon S3 Pricing aws.amazon.com](https://aws.amazon.com/s3/pricing/) - [COST08-BP03 Implement services to reduce data transfer costs docs.aws.amazon.com](https://docs.aws.amazon.com/wellarchitected/latest/framework/cost_data_transfer_implement_services.html) - [Restrict access to an Amazon S3 origin docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS CloudFront CER-0351 ### [Low Cache Hit Ratio on CloudFront Distributions](https://www.pointfive.co/efficiency-hub/inefficiencies/low-cache-hit-ratio-on-cloudfront-distributions) A CloudFront distribution only saves origin cost when it serves responses from cache. When cache behaviors include all query strings, all cookies or high-cardinality headers such as User-Agent in the cache key, or when objects carry short... Networking - AWS CloudFront CER-0352 ### [CloudFront Price Class Broader Than the Audience](https://www.pointfive.co/efficiency-hub/inefficiencies/cloudfront-price-class-broader-than-the-audience) By default, a CloudFront distribution delivers content from its entire global network of edge locations, which is Price Class All. CloudFront pay-as-you-go rates depend on the geography of the edge that serves the request, and data... Networking - AWS NAT Gateway CER-0325 ### [Excessive NAT Gateway Data Processing Charges from Unoptimized Traffic Routing](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-nat-gateway-data-processing-charges-from-unoptimized-traffic-routing) NAT Gateway charges a per-gigabyte data processing fee on all traffic that passes through it - in either direction - regardless of whether the destination is the public internet or another AWS service in the same region. This per-GB charge... Networking --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.