Content delivery and replication costs (CloudFront, Origin Shield, CRR): SAP-C03 study notes and practice questions

What to know for the exam

SAP-C03 asks how to serve a global audience cheaply and how to keep copies in other Regions without doubling the bill. The right answer raises the cache hit ratio and replicates only what a requirement needs.

CloudFront and cost

• Data transfer from AWS origins (S3, ALB, EC2, API Gateway and others) to CloudFront is free. You pay CloudFront’s edge transfer and request prices, which are lower than direct internet egress from most Regions at volume.
• Every cache miss is an origin request: more load, more origin compute and sometimes more transfer. The cache hit ratio is the main cost lever.
• Cache policies decide the cache key. Include only the headers, cookies and query strings that change the response; forward the rest with an origin request policy so they don’t split the cache.
• Set long TTLs with versioned file names for static assets, and compress with gzip or Brotli.
• Origin Shield adds a central caching layer in one Region in front of the origin. All edge locations fetch through it, so the origin sees far fewer requests. It has its own per-request charge, so it pays off for origins with many edge locations missing on the same objects, live or on-demand video, or costly on-premises or cross-Region origins. Choose the Origin Shield Region closest to the origin.
• Origin access control (OAC) keeps S3 private behind CloudFront so users cannot bypass the cache.
• Price classes limit which edge locations serve you, trading some latency in distant areas for lower cost.

Origin failover

An origin group with a primary and secondary origin retries a request on the secondary when the primary returns a configured error code or times out. Pair it with an S3 bucket replicated to a second Region for a low-cost static DR site. This covers GET, HEAD and OPTIONS requests only.

Cost-aware replication

• S3 Cross-Region Replication (CRR) copies new objects asynchronously. You pay inter-Region transfer, replication requests and storage in the destination. Cut cost by:
  • Filtering on prefix or tag so only required data replicates.
  • Writing replicas straight to a cheaper storage class (such as Standard-IA or Glacier classes) in the destination.
  • Using S3 Replication Time Control only when a requirement needs predictable replication time (it adds a charge).
  • Using S3 Batch Replication for existing objects, once.
• Same-Region Replication avoids inter-Region transfer when the requirement is a second account, not a second Region.
• DynamoDB global tables charge replicated writes in every replica Region plus storage in each. Add replicas only in Regions that serve traffic or DR needs, and remember every write is paid for in every Region.

How to choose

Common traps

• Forwarding all headers and cookies, which turns the cache into a pass-through.
• Origin Shield for a small site with a single nearby origin.
• Replicating whole buckets to Standard in another Region when a cheap class or a filter would do.
• Expecting CRR to copy existing objects without Batch Replication.
• Adding global table replicas in Regions with no users.

Try the 1 practice question ↓