AWS Edge Services - Cost optimization
In addition to its benefits for performance, security and availability of web applications, CloudFront can be used to reduce the costs of serving web applications from AWS.
Overview
In addition to its benefits for performance, security and availability of web applications, CloudFront can be used to reduce the costs of serving web applications from AWS. First, CloudFront's pricing model could reduce your origin costs. Second, you can configure your CloudFront and architect your application to decrease its costs. For more general guidance on optimizing costs using AWS services, consider the Cost Optimization Pillar of the AWS Well-Architected Framework. To monitor and understand your costs, use AWS Cost Explorer and AWS Budgets .
Using CloudFront to reduce your web application costs
CloudFront natively reduces the costs of your web application, by offloading your origin. First, CloudFront serve cacheable requests from its own cache, which reduces the scaling costs of your origin. You can optimize your CloudFront configuration to further offload the origin by increasing the Cache Hit Ratio (e.g. enabling Origin Shield). Second, CloudFront reuses TCP/TLS connections to your origin for dynamic requests (e.g. API calls), which reduces the number of new connections that needs to be handled by the origin, and the amount of TLS certificates egressing from the origin. This reduces the costs of origins like ALB because the LCU consumption decreases thanks to the reduced number of newly established connections per second and the number of bytes processed.
You can configure CloudFront to further reduce your costs in different ways. For example, compress text files using GZIP or Brotli to reduce DTO.
CloudFront cost optimization
CloudFront can be consumed using two pricing models: Flat-rate pricing plans , and pay-as-you-go pricing . You can have CloudFront distributions in the same AWS Account using one or the other pricing model.
Flat-rate pricing plans
CloudFront flat-rate pricing plans combine CloudFront with multiple AWS services and features, such as AWS WAF inlcuding DDoS protection and bot management, Route 53 DNS, CloudWatch Logs ingestion, CloudFront functions and S3 storage credits, into a monthly price with no overage charges, starting with a $0/month Free plan.
This is the most cost effective option when the usage on a distribution fit the limits of different plans, wether in terms of functionality or in terms of volumetry. Read more about these limits in the CloudFront documentation .
Pay-as-you-go pricing
Consider this pricing model when the flat-rate pricing plans do not fit your requirements. CloudFront's pay-as-you-go pricing model includes multiple dimensions, with the two most dominant ones being:
- The Regional Data Transfer Out (DTO) to Internet, which accounts for the amount of GBs served by CloudFront to users on the internet. Note that this pricing depends on the region of users, it's metered using binary gigabytes (i.e. 1 GB = 1024 MB), and it only includes the HTTP payload (e.g. excluding TLS handshake data transfer). It's important to note that when used with an AWS based origin, CloudFront's DTO replaces the origin's DTO. As of such, you do not pay the Data Transfer Out (DTO) of the origin.
- The Request fees, which accounts for the number of HTTP(S) requests served by CloudFront. It also depends on the region of the users.
CloudFront has an always on Free tier, that includes every month 1 TB of DTO and 10 Million HTTP(S) requests. To optimize CloudFront cost beyond the free tier, consider the following options:
- Price Class configuration: By default, CloudFront uses all its network to serve content for the best performance. Consider configuring Price Class options in CloudFront if you are willing to strike a tradeoff with the delivery costs.
- CloudFront security Saving bundles. If you are using AWS WAF in combination with CloudFront, consider an upfront commitment with the CloudFront security savings bundle to save up to 30% on the CloudFront charges.
- Private pricing. For larger volumes (10TB+), contact AWS to obtain further reductions in return of a higher financial commitment, by signing a private pricing agreement. Note that the discount you can obtain is bigger when your overall traffic has a higher average size of delivered HTTP objects. As a consequence, it is recommended to use CloudFront for multiple workloads (API delivery and static file delivery) to increase the overall discount you can get in a private pricing agreement.
Optimize the usage of paid CloudFront features
Review and optimize your usage of CloudFront's optional features, that could generate extra costs, such as content invalidation , edge functions and logging. Consider the following techniques to optimize the cost of paid features:
- Invalidations. You can use 1,000 paths for invalidation each month at no additional charge. Beyond that it costs $0.005 per path requested for invalidation. A path listed in your invalidation request represents the URL (or multiple URLs if the path contains a wildcard character) of the object(s) you want to invalidate from CloudFront cache. To reduce the usage of invalidations, rely on HTTP cache control mechanisms (e.g. Cache-Control header, URL versioning, conditional requests) by default to control the freshness of cached content in CloudFront, and when you have to use invalidations, leverage wildcards or tags when applicable to invalidate multiple files with a single invalidation request. For example, use /stories/sports/worldcup* to invalidate all articles related to Worldcup event, instead of invalidating them one by one. You can monitor your Invalidations usage and set alarms using AWS Budgets .
- Edge functions: Follow best practices explained in this article , such as Associate an Edge function to the most specific cache behavior, and use CloudFront Functions instead of Lambda@Edge when possible.
- Logging. Consider all logging options and select most cost efficient one for you. CloudFront's standard access logs is provided at no additional charges, allows you to select specific fields to log, in different formats (JSON, Parquet, etc..), however it applies to all your traffic. CloudFront's real time logs are granularly configured by at a Cache Behavior level, can be sampled, and allow you to select specific fields to log, however they are not free of charge.
AWS WAF cost optimization
The dominant component in AWS WAF cost are usually the request fees. You can reduce this cost in different ways:
- Enable AWS WAF exclusively on the CloudFront distribution that requires protection according to your threat modeling. For example, if your static content hosted on S3 do not require WAF protection, move them to a separate domain (e.g. static.example.com) on a separate CloudFront distribution, and only enable AWS WAF on the main distribution (e.g. www.example.com ) which is serving your HTML files.
- When you subscribe to Shield Advanced , the AWS WAF request fees are included in Shield Advanced pricing. Shield Advanced charges a monthly subscription, and a premium fee on your application Data Transfer Out. If your application is request intensive (High request per second with low average payload, e.g. with APIs), Enabling Shield Advanced might help you reduce your overall WAF costs.
- Finally, some AWS WAF rules have additional costs, such as CAPTCHA, Bot Control or managed rules by vendors in the AWS Marketplace. Optimize these costs by scoping down such rules to specific conditions (e.g. only CAPTCHA suspicious IPs or only apply Bot Control on HTML requests), and by using at the end of the WebACL, giving the chance for prior free rules to block malicious requests at no additional cost. Read the following blog for more in-depth explanation of WAF rule cost optimizations:
- AWS WAF offers multiple logging options , consider the tradeoffs between their attributes and their cost. AWS WAF includes 500 MB of CloudWatch Logs Vended Logs Ingestion for every 1 million WAF requests processed, at no additional cost. Note that you can filter logged requests based on dimensions like rule action or emitted label to better manage your log cost.
Minimizing the cost of resources used by DDoS attacks
When your web application is target to DDoS attacks, resources such as EC2 scaling, ALB LCU, CloudFront requests, etc.. are unnecessarily used on your behalf. Consider the following billing characteristics at AWS when you want to minimize the necessary cost of DDoS attacks:
- When requests received by a CloudFront resource are blocked by an associated AWS WAF WebACL, the CloudFront cost associated with these requests is waived.
- When a DDoS attack is detected and mitigated by the AWS WAF Anti-DDoS AMR, the following WAF costs due to mitigated DDoS requests are waived: The base request fee (0.6$/ million processed requests) and the Anti-DDoS AMR request Fee (0.15$/ million processed requests).
- If a CloudFront resource is protected by Shield Advanced, the previously mentioned WAF costs are waived for all incoming requests.
- DDoS requests that are not mitigated by AWS WAF, incur resource costs in CloudFront, in AWS WAF and on the origin due to scaling. If the associated CloudFront resource is protected by Shield Advanced, you can compensate these costs through a credit request.
- Logging costs due to DDoS attacks can also be optimized. Using labels generated from the Anti-DDoS AMR, you can exclude certain requests from being logged, such as requests tagged as contributing to DDoS attacks with medium or high suspicion.
Application level optimizations
There are techniques on the application level that you can implement to reduce the costs of CloudFront delivery. Consider the following techniques:
- Leverage browser caching to reduce the amount of requests delivered by CloudFront
- Implement ETags on your objects to enable conditional requests. Object refreshes with 304 Not Modified responses are cheaper to deliver compared to full fetches.
- Implement image optimization to compress images using modern formats such as WebP and Avif. In addition, lazy load images on your website to avoid downloading ones that are not rendered by browsers.
- Implement Adaptive Bit Rate streaming for video delivery. Consider QVBR video encoding . Consider delivering optimized rendition ladder according to device types. This blog explains this concept, however it was written using Lambda@Edge prior to launching CloudFront Functions.
- Use a Same Origin Policy if possible for API calls, which removes the cost of preflight CORS OPTION requests. Read this blog for further details.
Resources
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article