S3, Cloudflare R2 or DigitalOcean Spaces: real storage costs

For a small SaaS that serves user uploads or static assets, the storage price per gigabyte barely matters; what you pay for is data going out to the internet. At the time of writing (October 2026), serving 2 TB a month straight from Amazon S3 costs about $175 in egress alone, the same traffic through CloudFront about $87, from DigitalOcean Spaces about $10, and from Cloudflare R2 nothing, because R2 does not charge for egress.

This comparison uses the providers' published list prices to cost one realistic workload, explains the line items that surprise people, and ends with a short decision guide. Prices change, so the cost model is included as code you can re-run with your own numbers.

The price list, side by side

All prices are US dollars, list prices for the default or US region, checked against official pricing pages in October 2026. Taxes are excluded.

For CloudFront, the pay-as-you-go price in the United States, Mexico and Canada is $0.085 per GB after an always-free 1 TB per month, plus $0.0100 per 10,000 HTTPS requests after 10 million free requests. Fetches from an S3 origin to CloudFront are free. In India the per-GB rate is $0.109.

A worked example: 500 GB stored, 2 TB served

Take a SaaS that stores 500 GB of user files, serves 2 TB (2,048 GB) a month, takes 1 million uploads and serves 20 million downloads. For the CloudFront case, assume 10% of requests miss the cache and go to S3.

The calculation, so you can change the inputs and the prices:

// Monthly object storage cost model. Prices: list prices, October 2026.
const usage = { storedGB: 500, egressGB: 2048, writes: 1_000_000, reads: 20_000_000 };

const s3Direct = (u) =>
  u.storedGB * 0.023 +                      // S3 Standard, first 50 TB, us-east-1
  Math.max(0, u.egressGB - 100) * 0.09 +    // internet egress after 100 GB free
  (u.writes / 1000) * 0.005 +               // PUT, COPY, POST, LIST
  (u.reads / 1000) * 0.0004;                // GET

const s3CloudFront = (u, missRate = 0.1) =>
  u.storedGB * 0.023 +
  (u.writes / 1000) * 0.005 +
  ((u.reads * missRate) / 1000) * 0.0004 +  // origin GETs on cache misses
  Math.max(0, u.egressGB - 1024) * 0.085 +  // CloudFront US: 1 TB free, then $0.085/GB
  (Math.max(0, u.reads - 10_000_000) / 10_000) * 0.01; // HTTPS requests after 10M free

const r2 = (u) =>
  Math.max(0, u.storedGB - 10) * 0.015 +              // 10 GB-month free
  (Math.max(0, u.writes - 1_000_000) / 1e6) * 4.5 +   // Class A after 1M free
  (Math.max(0, u.reads - 10_000_000) / 1e6) * 0.36;   // Class B after 10M free; egress free

const spaces = (u) =>
  5 +                                       // includes 250 GiB stored, 1,024 GiB out
  Math.max(0, u.storedGB - 250) * 0.02 +
  Math.max(0, u.egressGB - 1024) * 0.01;

for (const [name, fn] of Object.entries({ s3Direct, s3CloudFront, r2, spaces })) {
  console.log(name.padEnd(13), '$' + fn(usage).toFixed(2));
}

The model treats GB and GiB as equal for Spaces and counts 1 TB as 1,024 GB for the CloudFront free tier, so treat results as estimates within a few per cent. It also ignores tax, the 100 GB AWS free egress in the CloudFront case, and minimum billing rules on infrequent-access classes.

CloudFront's flat-rate plans change the picture

CloudFront now also sells flat-rate plans per distribution with "no additional overage charges": Free ($0, 1 million requests and 100 GB), Pro ($15, 10 million requests and 50 TB), Business ($200, 125 million requests and 50 TB) and Premium ($1,000). They bundle DNS, DDoS protection, AWS WAF rules and S3 storage credits (50 GB on Pro, 1 TB on Business). In the example, 20 million requests exceed the Pro allowance, so the fit would be Business at $200. A site with heavy transfer but fewer than 10 million requests a month would fit Pro at $15, which makes S3 plus CloudFront competitive again. Check how your request count, not just your bandwidth, maps to a plan.

What the price tables do not show

Amazon S3

• Request charges add up on small files. Thumbnails and tiny JSON objects can cost more in GET requests than in storage.
• LIST is billed like a write. Code that lists a bucket on every page view gets expensive; keep an index in your database.
• Strengths: the deepest feature set (lifecycle rules, many storage classes, replication, event notifications, fine-grained IAM) and data transfer that is free within AWS to services in the same region.

Cloudflare R2

• Class A includes ListObjects, at $4.50 per million. As with S3, avoid listing buckets in hot paths.
• Use a custom domain in production. Cloudflare documents the r2.dev public URL as rate-limited and for development only. A custom domain enables Cloudflare's cache, WAF rules and access controls; by default only certain file types are cached, so add a cache rule if you want everything cached.
• Infrequent Access is not free to read. R2's Infrequent Access class is $0.01 per GB-month but adds a $0.01 per GB retrieval fee, higher operation prices and a 30-day minimum.
• Fewer features than S3, and other Cloudflare services connected to a bucket may be billed separately.

DigitalOcean Spaces

• You pay $5 a month from the first bucket, even if it is empty, until you delete all buckets.
• CDN traffic counts against transfer. Both origin and CDN traffic use the 1,024 GiB allowance, which is separate from your Droplets' allowance.
• Cold Storage has small-object rules: objects under 128 KiB are billed as 128 KiB, and each read has a 128 KiB minimum retrieval charge.
• Strengths: predictable bills, a simple pricing page and an included CDN.

Keep the choice reversible

All three services speak the S3 API, so the cheapest insurance is to write your app against that API and put the endpoint in configuration. With the AWS SDK for JavaScript v3:

import { S3Client } from '@aws-sdk/client-s3';

// Same SDK, different endpoint: switch providers with configuration, not code.
export const storage = new S3Client({
  region: process.env.S3_REGION,            // e.g. 'us-east-1', 'auto' for R2, 'nyc3' for Spaces
  endpoint: process.env.S3_ENDPOINT,        // omit for AWS S3
  credentials: {
    accessKeyId: process.env.S3_ACCESS_KEY_ID,
    secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
  },
});

Store object keys, not full URLs, in your database, and build public URLs from a configurable base URL (your CDN domain). Then moving providers is a bulk copy plus a configuration change, not a data migration.

Which one should you pick?

• Your app already runs on AWS and traffic is modest: S3 with CloudFront. Compare the Free or Pro flat-rate plan against pay-as-you-go for your request count.
• Egress is your biggest cost (video, downloads, image-heavy apps, public datasets): Cloudflare R2 with a custom domain.
• You host on DigitalOcean and want one simple bill: Spaces. Its included 250 GiB and 1,024 GiB cover many early-stage products for $5.
• Compliance or data-residency rules apply: pick the provider and region that meet them first, then optimise cost within that choice.

What to do next

1. Pull last month's real numbers: stored GB, GB served, and request counts from your provider's billing or metrics.
2. Run the cost model with those numbers and with ten times the traffic.
3. Put a CDN in front of whatever you choose and set long cache lifetimes on immutable, versioned file names.
4. Set a billing alert at the amount you expect, so a hotlinked file or a runaway LIST loop is caught in days, not at month end.