Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Why Cloud Contracts Now Charge for CloudFront Origin Shield Requests
Transcript
- Lucas: So you've set up CloudFront with Origin Shield to protect your origin from that flash crowd during a product launch. Great idea, except the bill now shows a line item you didn't budget for: Origin Shield request fees. Luna: Wait — you're telling me we pay for the shield, and we also pay every time a request actually hits the shield? Even if it's a cache miss and goes all the way to the origin anyway? Lucas: Exactly. That's the change that's been creeping into enterprise contracts over the past few quarters. Until recently, Origin Shield was bundled into standard CloudFront request pricing. But now, many renewals include a separate charge per 10,000 requests that reach the shield layer. Luna: How much are we talking? Give me a number I can take to my finance team. Lucas: The current public price is $0.0075 per 10,000 requests — that's seventy-five one-hundredths of a cent. On the surface, that's cheap. But if your site does 50 million requests a month — which is modest for a mid-size e-commerce operation — that's $375 a month. Purely for the shield. Luna: And that's on top of the standard CloudFront request fee and the data transfer out. So a million-request-per-day site could be paying an extra hundred bucks a month for a feature many teams enabled with one click and forgot about. Lucas: Right. The real kicker is that you're charged even when the shield doesn't help. A cache miss means the request goes from the viewer to the edge, then to the shield, then to the origin. You pay for both the edge request and the shield request — even though the origin still had to serve the content. Luna: So what's the actual benefit of Origin Shield now? It used to be a no-brainer for any site with a high request volume. You'd get a higher cache hit ratio because the shield aggregates requests from multiple edge locations. Lucas: The benefit still exists, but it's no longer free. The question becomes: does the savings in origin load — and the associated compute and bandwidth — outweigh the shield request fee? For a site with a 90 percent cache hit ratio, the shield is probably still worth it because only 10 percent of requests go to the origin anyway. But for a site with a 50 percent hit ratio, you're paying the shield fee on every single request including the half that miss, and the origin is still getting hammered. Luna: So the cost-benefit calc depends entirely on your cache hit ratio. And most teams don't actually know their cache hit ratio at the shield level — they measure it at the edge. Lucas: That's the blind spot. CloudFront reports cache hit ratio at the edge, but the shield has its own cache. You need to dig into the Origin Shield metrics in CloudWatch to see how many requests the shield intercepted and how many of those were served from its cache versus forwarded to the origin. Luna: If today was actually useful to you — and I hope it is — these deep dives into cloud billing are exactly why we keep this show ad-free. The way that stays possible is listener support. You can buy me a coffee dot com slash fexingo. No pressure, just if you got value. Lucas: Yeah, it's a small gesture that keeps the lights on without advertisers. And we genuinely appreciate every single one. Alright — let's get back to the practical stuff. Lucas: So let's talk about how to actually decide if Origin Shield is still worth it. The first step is to enable the Origin Shield cache hit ratio metric. It's not on by default. You have to add a CloudWatch metric for 'Origin Shield Cache Hit Rate' per distribution. Luna: And once you have that number, what's the threshold? At what point do you turn off Origin Shield? Lucas: I've seen analysis from cloud optimization firms suggesting that if your Origin Shield cache hit ratio is below 60 percent, the shield is actually costing you more than the origin savings. Below that, you're better off relying on standard CloudFront caching plus maybe a smaller origin fleet or auto-scaling. Luna: So the sweet spot is above 70 percent. But what about high-traffic events, like a product drop or a Super Bowl ad? You might want the shield just for those hours. Lucas: Great point. You can enable Origin Shield on a per-distribution basis via the CloudFront API. So you could write a Lambda function that toggles it on during predicted flash crowds and off the rest of the time. That way you only pay for the shield request fees during the high-traffic window. Luna: Is that practical? Would AWS charge you for the API calls to update the distribution? Lucas: They do charge for CloudFront API calls — $0.005 per 10,000 requests — so the cost of toggling is negligible. The hard part is predicting the traffic surge. But if you have a known launch window, it's cheap insurance. Luna: What about alternatives? Could you get similar origin protection by using regional edge caches instead? Lucas: Regional edge caches are the predecessor to Origin Shield. They're still available and they don't have a separate request fee — they're included in the standard CloudFront pricing. But they also don't offer the same level of aggregation. There are three tiers of regional edge caches globally, whereas Origin Shield is a single point per region. Luna: So if you have a global audience, Origin Shield is more effective because it aggregate across all edges. But you pay for that aggregation now. Lucas: Exactly. Another option is to use a custom origin with aggressive caching headers and skip the shield entirely. But that requires more careful tuning of Cache-Control max-age and s-maxage directives. If you get it wrong, your origin gets hammered. Luna: So the net takeaway: Origin Shield is no longer a free add-on. You need to measure your cache hit ratio, compare the shield request cost to the origin savings, and maybe use it only when needed. Cloud billing just got a little more granular. Lucas: And that's the trend across all three major cloud providers. Every layer of infrastructure is becoming a metered line item. The old days of all-you-can-eat bandwidth and unlimited request tiers are fading. For operators, that means you need to understand the cost model before you enable any new feature.