CDN origin shield cost: paying a little to protect the origin

Quick answer

CloudFront Origin Shield costs about 0.0075 to 0.009 dollars per 10,000 requests depending on the shield region, billed on requests that pass from the edge layer into the shield. It consolidates fetches from roughly 600 edge locations down to one regional cache, which typically raises the effective origin offload from around 80 percent to 95 percent or better. For an origin serving 500 million requests per month at a 20 percent miss rate, the shield costs about 375 dollars and can cut origin fetches from 100 million to under 25 million, so it pays when origin compute, origin request fees, or origin egress exceed that premium.

A CDN is not one cache. It is hundreds of independent caches at edge locations around the world, and each of them misses independently. The first request for an object in Frankfurt does not benefit from the fact that Sydney fetched it an hour ago. For a large object catalog that independence means the origin sees far more traffic than a naive hit-ratio calculation would suggest.

What origin shield does

Origin shield designates one region as an additional caching tier between the edge layer and your origin. Every edge miss routes to the shield rather than to the origin directly. If the shield has the object, the origin never sees the request. Because all edges funnel through one place, the origin sees roughly one fetch per object per cache lifetime rather than one per object per edge location.

Layer	Typical offload	Origin fetches per 100M requests
Edge only	80 percent	20,000,000
Edge plus regional tier	90 percent	10,000,000
Edge plus shield	95 to 99 percent	1,000,000 to 5,000,000

The pricing

CloudFront charges origin shield per 10,000 requests that reach the shield layer, at rates that vary by shield region: roughly 0.0075 dollars per 10,000 in North America and Europe and up to about 0.009 in other regions. Requests served from an edge cache never reach the shield and are not charged. So the cost scales with the edge miss volume, not with total traffic.

For a distribution serving 500 million requests per month with an 80 percent edge hit ratio, 100 million requests reach the shield. At 0.0075 dollars per 10,000 that is 75 dollars per month. If the edge hit ratio is only 50 percent, 250 million requests reach the shield and the cost is about 187 dollars. Either way the premium is modest in absolute terms.

What it saves

The savings come from three places. First, origin request fees: if the origin is S3 at 0.0004 dollars per 1,000 GET requests, cutting origin fetches from 100 million to 5 million saves 38 dollars per month, which alone roughly pays for the shield. Second, origin compute: if the origin is an application generating responses, cutting fetches by 95 percent may let you run a much smaller fleet, and that is usually the dominant saving. Third, origin egress where the origin is not in the same cloud as the CDN, in which case every avoided fetch avoids an internet egress charge at 0.09 dollars per GB.

That third case is the strongest. A CDN pulling from an origin hosted outside the cloud pays real bandwidth on every miss. Going from 20 percent misses to 2 percent on a 50 TB catalog cuts origin egress from 10 TB to 1 TB, saving roughly 830 dollars per month against a shield fee of well under 200 dollars.

When it does not pay

Origin shield is a poor fit for three patterns. Highly dynamic content that is never cacheable passes through the shield without benefiting, so you pay the per-request fee for nothing. Very small catalogs already achieve high edge hit ratios because every edge warms quickly, leaving little offload to gain. And a long-tail catalog where most objects are requested once ever gets no benefit either, because a single request cannot hit a cache no matter how many tiers exist.

There is also a latency consideration. Adding a hop means an edge miss travels to the shield before reaching the origin. If the shield is geographically far from both the edge and the origin, cold requests get slower. The shield region should be chosen close to the origin, not close to the audience.

Tuning the inputs

Before paying for a shield, make sure the cheap fixes are done. Cache keys that include unnecessary query strings, cookies, or headers fragment the cache and destroy hit ratios; normalizing them is free and often more effective than a shield. Short TTLs force refetches; extending cache lifetimes on immutable assets and using content-hashed filenames to invalidate by name is free as well. These and other levers are covered in CDN cache hit ratio economics.

The decision rule

Estimate monthly edge misses, multiply by the shield rate to get the cost, then estimate what those avoided origin fetches are worth in request fees, compute, and egress. If the origin sits outside the CDN provider's cloud, or if origin compute is a meaningful part of your bill, the shield almost always wins. If the origin is S3 in the same account with free origin fetches and a small catalog, it often does not. Price your delivery architecture against the resource catalog before deciding.

FAQ

What does CloudFront Origin Shield cost?

Roughly 0.0075 dollars per 10,000 requests in North America and Europe, and up to about 0.009 per 10,000 in other shield regions, charged only on requests that miss at the edge and reach the shield layer. A distribution serving 500 million requests per month at an 80 percent edge hit ratio sends 100 million to the shield, costing about 75 dollars per month.

How much does origin shield improve offload?

Typically from around 80 percent with edge caching alone to 95 percent or better. Without a shield, each of roughly 600 edge locations misses independently, so the origin sees many fetches for the same object. Funneling all edge misses through one regional cache means the origin sees roughly one fetch per object per cache lifetime instead of one per object per edge.

When is origin shield worth paying for?

When the avoided origin fetches cost more than the shield premium. The strongest case is an origin hosted outside the CDN provider's cloud, where every miss pays internet egress at 0.09 dollars per GB: cutting misses from 20 percent to 2 percent on a 50 TB catalog saves about 830 dollars against a shield fee under 200 dollars. Heavy origin compute is the other strong case.

When does origin shield not help?

With highly dynamic uncacheable content, which passes through the shield paying per-request fees for no benefit; with very small catalogs, where every edge warms quickly and there is little offload left to gain; and with long-tail catalogs where most objects are requested once ever, since a single request cannot hit any cache regardless of how many tiers exist.

Where should the shield region be placed?

Close to the origin, not close to the audience. Adding a shield inserts a hop, so an edge miss travels to the shield before reaching the origin. If the shield is far from both, cold requests become noticeably slower. Placing it near the origin keeps the extra hop short and preserves most of the latency benefit of the consolidation.

How does C3X help with CDN cost?

C3X prices delivery infrastructure from Terraform before deployment, including CDN distributions, origin configuration, and the storage or compute serving as the origin. Because origin shield economics depend on comparing a per-request fee against avoided origin request, compute, and egress charges, having the full priced picture at design time is what makes that comparison possible.

What to do next

Compare CDN configurations by cost before you deploy. C3X prices Terraform against a live resource catalog. Start with the quickstart.