AWSAmazon S3Storage

`aws_s3_bucket_cors_configuration` cost estimation

Defines cross-origin resource sharing rules for an S3 bucket. The CORS config is free. It enables browsers to fetch objects directly, which drives the request and data transfer charges on the bucket.

The aws_s3_bucket_cors_configuration resource sets the cross-origin resource sharing (CORS) rules on an S3 bucket. CORS rules tell browsers which origins, methods, and headers are allowed when JavaScript running on one domain requests objects from the bucket on another. Defining CORS rules is a free control-plane operation, there is no charge for the configuration itself.

What CORS enables is where the cost appears. CORS exists specifically to let browsers pull objects directly from S3, whether that is a single-page app fetching assets, a web client doing multipart uploads, or a frontend downloading user files. Every one of those browser requests is a billable S3 request (about 0.0004 dollars per 1,000 GET requests for Standard) and every byte returned to the browser over the internet is billable data transfer out (about 0.09 dollars per GB after the free tier). A permissive CORS policy that allows a high-traffic web app to hit the bucket directly can therefore generate significant request and egress charges even though the CORS rule cost nothing.

There is also a preflight consideration. Browsers send an OPTIONS preflight request before certain cross-origin calls. Those preflight requests are billable GET-class requests too, so a chatty client can roughly double request volume. Setting a sensible MaxAgeSeconds lets browsers cache the preflight result and cut that overhead.

The common cost-optimization move is to not serve browser traffic directly from S3 at all. Putting Amazon CloudFront in front of the bucket lets the CDN handle CORS response headers, cache objects at the edge, and serve repeat requests without touching S3, which cuts both S3 GET volume and origin egress. Direct-from-S3 CORS is fine for low-traffic or internal apps but expensive at scale.

c3x reports aws_s3_bucket_cors_configuration as free and attributes the resulting request and transfer spend to the aws_s3_bucket and any CloudFront distribution in front of it.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_s3_bucket" "assets" {
  bucket = "my-web-app-assets"
}

resource "aws_s3_bucket_cors_configuration" "assets" {
  bucket = aws_s3_bucket.assets.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = ["https://app.example.com"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3600
  }
}

Pricing dimensions

What you actually pay for when you provision aws_s3_bucket_cors_configuration.

Dimension	Unit	What's being charged
S3 CORS configuration	free	Defining or updating CORS rules is a free control-plane operation. $0 (free)
S3 GET requests	per 1,000 requests	Browser fetches and OPTIONS preflight calls enabled by CORS are billable GET-class requests. $0.0004 per 1,000 GET (Standard, us-east-1)
S3 data transfer out	per GB	Bytes returned to the browser over the internet after the free tier. $0.09 per GB (first 10 TB/month, us-east-1)
CloudFront delivery (recommended front)	per GB + per 10,000 requests	Serving assets via CloudFront instead of direct S3 CORS caches at the edge and can lower total cost at scale. $0.085 per GB + $0.0075 per 10,000 HTTPS requests (US/EU)

Optimization tips

Common ways to reduce aws_s3_bucket_cors_configuration cost without changing the workload.

Serve browser assets through CloudFront

Large reduction in S3 GET and egress at scale

Put a CloudFront distribution in front of the bucket and let it handle CORS headers. Edge caching serves repeat requests without hitting S3, cutting both GET request volume and origin egress for high-traffic web apps.

Set a generous max_age_seconds to cache preflights

Every cross-origin preflight is a billable OPTIONS request. A higher MaxAgeSeconds lets browsers cache the preflight decision so they stop re-sending it, roughly halving request overhead for chatty clients.

Scope allowed_origins to real domains

Avoid a wildcard allowed_origins of asterisk on public buckets. Restricting to your own domains does not change price directly but prevents other sites from embedding your objects and driving your egress bill.

Use presigned URLs for uploads instead of broad CORS

For user uploads, presigned PUT URLs let clients upload directly with tightly scoped, time-limited permission, so you can keep the CORS surface small and avoid exposing broad write access.

FAQ

Does S3 CORS configuration cost anything?

No. Defining CORS rules is free. The cost comes from the browser requests and data transfer that CORS makes possible, which bill against the underlying S3 bucket.

How can a free CORS rule lead to a big bill?

CORS lets browsers fetch objects directly from S3. A high-traffic web app pulling assets straight from the bucket generates billable GET requests and internet egress on every load. Fronting the bucket with CloudFront caches those requests and reduces the cost.

Do preflight requests cost money?

Yes. Browser OPTIONS preflight requests are billable GET-class S3 requests. Setting max_age_seconds lets browsers cache the preflight result so they send fewer of them.

Is direct-from-S3 CORS ever the right choice?

For low-traffic, internal, or admin tools, serving directly from S3 with CORS is simple and cheap. At scale or for public-facing apps, CloudFront in front of the bucket is usually more cost-effective and adds caching.