S3 vs CloudFront vs CDN: Startup Cost Truth for 2026

For most early-stage apps serving under ~1 TB of static assets a month, CloudFront in front of a private S3 bucket is the cheapest sane default — not raw S3 URLs, and not a premium third-party CDN. The reason is the one line item that surprises everyone: S3’s data-transfer-out to the internet costs about $0.09/GB, while CloudFront’s egress starts around $0.085/GB and drops as you scale, and CloudFront’s first 1 TB/month is on the AWS Free Tier. Below that threshold, a third-party CDN rarely beats the native path on price. The honest nuance is that it depends on your traffic tier, so this post lays out the matrix.

Why raw S3 is a cost trap for public assets #

Serving assets straight from a public S3 bucket feels simplest, and for a few hundred megabytes of traffic it costs cents. The trap is that you pay full S3 egress — roughly $0.09/GB — on every byte, with no caching layer, and you pay a GET request charge (about $0.0004 per 1,000 requests) on every single asset fetch. A site with 2 million asset requests a month and 500 GB of transfer is paying about $45 for egress plus ~$0.80 for requests — and because every visitor hits S3 directly, a traffic spike or a scraper hammers your origin and your bill at the same time.

There’s a security cost too. A public bucket is one misconfigured policy away from an open door. Putting CloudFront in front lets you keep the bucket private and lock origin access to the distribution. This is the same tight-by-default posture we argue for when generating security groups from your code: the narrower the surface, the fewer 2 a.m. surprises.

What CloudFront actually changes on the bill #

CloudFront earns its keep in two ways. First, cached responses are served from an edge location, so you stop paying S3 egress on repeat requests — only cache misses touch the bucket. On a typical static-asset workload a 90%+ cache hit ratio is normal, which means roughly a tenth of your traffic reaches origin. Second, the first 1 TB/month and 10 million HTTP/HTTPS requests are free under the AWS Free Tier, and this tier is not time-limited the way the twelve-month free tier is. For a startup under a terabyte, your CDN layer can be effectively $0 while S3-direct would have billed you $40–$90 for the same bytes.

Above the free tier, CloudFront egress to North America and Europe runs about $0.085/GB for the first 10 TB and declines with volume, plus about $0.0075 per 10,000 HTTPS requests. Invalidations are free for the first 1,000 paths a month, so the usual advice — use versioned filenames like app.4f2a.js instead of invalidating app.js — keeps that cost at zero. The one gotcha is that regional pricing varies: edge delivery to India and South America costs noticeably more per GB, so a globally distributed audience shifts the math.

When a third-party CDN wins #

Independent CDNs become compelling at two points. The first is when a provider offers flat-rate or bandwidth-included pricing that zeroes out egress — attractive once you’re consistently moving multiple terabytes and CloudFront’s per-GB charge dominates your bill. The second is feature-driven: edge compute, image optimization, or built-in DDoS posture you’d otherwise assemble yourself. For a pre-revenue app, neither usually applies, and adding a second vendor means a second DNS surface, a second cache to reason about, and a second place for config drift to hide. Keep it native until the egress line item genuinely hurts.

A decision matrix by traffic tier #

Here is the short version, and it’s the only list in this post because the ordering by scale is the point:

• Under 1 TB/month: CloudFront + private S3. The 1 TB free tier makes your CDN effectively free, and the bucket stays private.
• 1–10 TB/month: Still CloudFront in most cases — ~$0.085/GB with declining tiers beats S3-direct and avoids a second vendor. Watch regional egress if your audience is global.
• 10 TB+/month or heavy edge-compute needs: Price a flat-rate third-party CDN against CloudFront’s declining tiers; this is where independents start to win on raw bandwidth.

Whichever tier you’re in, the request-count and regional-mix numbers matter as much as the GB total, so pull your actual CloudFront or S3 usage from Cost Explorer before committing to a migration. Guessing costs more than measuring.

Where Vylara fits #

When the Vylara agent analyzes your repo, storage dependencies like @aws-sdk/client-s3 or multer surface on a plain "Your app needs" card — you pick "Create a storage bucket" (shown at roughly ~$1/mo for low-volume storage) or point at a bucket you already own. The bucket is provisioned in your own AWS account, so egress and request charges bill directly from AWS to you; Vylara charges for the orchestration layer, not your compute or transfer. That ownership model is the whole premise of deploying to your own AWS account — no reselling markup on bytes.

Remember that merging a PR from vylara-ai[bot] updates your repo with the Dockerfile and deployment config; the first deploy is what actually provisions the bucket and the rest of your environment in AWS. After launch, the in-app infrastructure chat can read your cost and usage data and flag when a line item — egress included — is creeping, the same way we treat other ambush charges in the anatomy of an AWS bill shock. For a wider view of right-sizing the whole stack, start from the AWS pillar guide.

The practical takeaway: default to CloudFront in front of a private S3 bucket, use versioned asset names to keep invalidations free, and only reach for a separate CDN once your monthly egress is measured in several terabytes or you need edge features AWS doesn’t give you cheaply. Under a terabyte, that layer costs you almost nothing — and raw public S3 is the most expensive "simple" option you can pick.