I Just Need To Optimize My AWS Egress Patterns

To preface: I’ve been doing pretty well for myself at minimizing my cloud spend. I just have a static site in S3 behind CloudFront, so the following table accounts for all of my spend¹:

So clearly, I don’t need to optimize my spend with it in the pennies n all, but there’s still a worrying trend, and I like optimizing, so optimize I shall.

What Happened In January?

Looking at CloudWatch metrics for my CloudFront distributions, we see that neither the number of requests nor the number of bytes downloaded lines up with the price increase I’m seeing²³:

Instead, what I think is happening is that I started analyzing my CloudFront access logs. Whoops!

What’s Wrong With The Access Log Egress Pattern?

I have two hypotheses:

1. You’re not supposed to put the files from CloudFront access logs into {yyyy}/{MM}/{dd} folders, because LIST requests are 10x as expensive as GET requests, or
2. There isn’t a way to use the S3 access logs w/o incurring this cost, because CloudFront just loves to put a bunch of tiny files in ur bucket, and GETing all those files will incur costs.

Unfortunately, I can’t really think of any way to solve this that doesn’t involve services that are more expensive (Firehose, CloudWatch Logs)⁴ or fetching the files in some other way (AWS Lambda behind API Gateway behind CloudFront) which would still eat most of the same LIST/GET costs.

Let’s Do Some Math

I have about 15000 objects in my log buckets, across 60 days. I check it about once a day, so looking at the S3 pricing page & accounting for the slightly nested nature of some of the folders, we get:

$ python
Python 3.11.11 (main, Dec  3 2024, 17:20:40) [GCC 13.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> 15000 * 0.0004 / 1000
0.006
>>> 30 * 65 * 0.005 / 1000
0.00975

hrm. That’s not right. That should only show up as $0.02 on my bill, and clearly it’s more than that, so I’m doing something wrong. Maybe it has to make a HEAD request to check if an object’s been updated?

>>> 30 * 15000 * 0.0004 / 1000
0.18

Now that’s roughly the same order of magnitude, but now it’s too large. Maybe I’m not actually checking my charts every day, but maybe I’m still doing my math wrong… Wait a minute, what about the PUT requests CloudFront makes to upload these objects in the first place?

>>> 15000 * 0.005 / 1000
0.07

Bingo, we have a winner. Doesn’t like up perfectly because I accidentally nuked part of it once, but yeah that’d do it, especially when combined with the uploads I do to my blog normally. Welp, nothing much I can do about that, mystery solved! So long as I actually run dashboard creation just once a day (or even more if I got that LIST calculation wrong), I think the cost will remain manageable (<$0.20); I’ve paid a lot more for not understanding the Oracle Cloud “Always Free” tier lol.

Log ingestion is hard!! Still working at it, GoAccess is really nice but still needs a way to get the data. Same with whatever dashboard software I decide to use next⁵.