James Mitchell
Why AWS can't match R2's pricing (even if they wanted to)
The numbers speak for themselves: AWS generated approximately $46 billion in data transfer revenue in 2025, based on Q4 earnings analysis. Eliminating egress fees would mean cannibalizing a line item that represents roughly 15% of AWS's total revenue. This isn't about technical capability—it's about defending a business model that depends on separating storage from networking.
Cloudflare can offer zero egress fees because R2 runs on top of their existing CDN infrastructure with 330+ global points of presence. The bandwidth cost is already amortized across their CDN operations. AWS charges $0.09 per GB for the first 10TB of outbound transfer because their architecture treats storage and networking as distinct services: every GB leaving S3 consumes bandwidth that AWS must provision and bill as a separate line item.
Google Cloud and Azure face the same structural problem. Their cloud businesses evolved from traditional data center models where compute, storage, and networking are metered independently. Cloudflare built R2 from the ground up as a CDN-native service, giving them a permanent cost advantage for high-egress workloads.
| Metric | Cloudflare R2 | AWS S3 |
|---|---|---|
| Architectural model | Distributed storage on CDN (330+ PoPs) | Centralized regional storage + separate networking |
| Egress cost per GB | $0.00 | $0.05 - $0.09 (varies by tier and region) |
| Revenue at risk if egress eliminated | $0 (already amortized in CDN) | ~$46B annually (critical line item) |
| Ability to replicate rival model | AWS cannot without restructuring pricing | Cloudflare has it by design |
Here's what this actually means: for workloads with high outbound traffic (media streaming, public backups, ML datasets, CDN origins), R2 has a competitive advantage that AWS cannot neutralize without fundamentally restructuring how they bill customers. As we've seen with alternative cloud architecture optimizations, foundational architectural decisions lock in pricing structures for years.
The compliance wall: where R2 stops and S3 begins
R2 lacks enterprise certifications that S3 has held since 2012. This blocks adoption in regulated sectors where compliance is non-negotiable, regardless of cost savings. If you're selling to Fortune 500 companies or operating in healthcare or fintech, this table determines whether R2 is even an option.
| Certification | AWS S3 | Cloudflare R2 | Impact |
|---|---|---|---|
| SOC 2 Type II | ✓ Since 2012 | ✗ Roadmap unconfirmed | Blocks SaaS B2B enterprise sales |
| HIPAA BAA | ✓ Eligible | ✗ Not available | Impossible for healthcare data (PHI) |
| PCI-DSS Level 1 | ✓ Certified | ✗ Not certified | Cannot store payment card data |
| ISO 27001 | ✓ Multi-region | ✗ Partial (Cloudflare network, not R2-specific) | Complicates risk assessment |
| FedRAMP | ✓ Moderate/High | ✗ Not applied | Vetoes US government contracts |
If your company sells to enterprise customers that require SOC 2 Type II in vendor assessments, using R2 as primary storage fails the audit. As we discussed in infrastructure decisions driven by compliance, regulatory certifications aren't negotiable in certain sectors.
Current workaround: keep S3 for compliance-critical data (user credentials, payment info, audit logs) and migrate only public or internal assets to R2 (images, videos, ML datasets with no PII).
Sectors where R2 is NOT viable today:
- Healthcare (HIPAA, patient data)
- Financial services (SOX, PCI-DSS for transactions)
- Government contractors (FedRAMP mandatory)
- Enterprise SaaS selling to Fortune 500 (SOC 2 Type II on vendor questionnaire)
Sectors where R2 works without issues:
- Media and entertainment (public content)
- Gaming (assets, patches, user-generated content with no PII)
- E-commerce (product images, catalogs)
- ML/AI research (public datasets, model weights)
- Developer tools (binaries, packages, documentation)
The bottom line is this: R2's pricing advantage disappears if you need to maintain a parallel S3 deployment for compliance. In my decade of analyzing productivity tools, I've seen too many teams discover compliance blockers after migration, forcing expensive rollbacks. Check your vendor security questionnaires before planning a migration.
S3 API compatibility: the 90% that works and the 10% that breaks your stack
R2 supports approximately 90% of the S3 API according to Cloudflare documentation and Vantage.sh analysis. Basic operations work without changes. It's frustrating that Cloudflare doesn't publish enterprise adoption metrics or documented cases of critical infrastructure migrations, but technical compatibility is verified.
What DOES work without modification:
- Standard CRUD operations (PUT, GET, DELETE, LIST)
- Multipart uploads for large files
- Bucket policies and Access Control Lists (ACLs)
- Presigned URLs with expiration
- Basic lifecycle policies (delete after N days)
- CORS configuration for browser access
- Integration with standard CLI tools (rclone, s3cmd, AWS SDK)
Critical limitations R2 does NOT support:
- Object Lock (WORM compliance for financial/healthcare regulations)
- S3 Glacier or equivalent for long-term archival
- S3 Select for direct SQL queries on objects
- S3 Batch Operations for programmatic mass operations
- S3 Inventory for automated audit of billions of objects
- Deep CloudTrail integration (logging of every API call for compliance)
- Advanced S3 Replication (cross-region, cross-account with complex filters)
- Versioning with MFA Delete (protection against accidental deletion by compromised admin)
If your workload depends on Object Lock for SOX compliance, or uses S3 Select for analytics on stored logs, R2 isn't a viable option today. Migration requires re-architecting those dependencies or maintaining a hybrid: S3 for compliance-critical data, R2 for public-facing assets.
The 10% that doesn't work tends to be the 10% you can't live without if you built deep integrations with AWS services. If you're triggering Lambda functions on S3 events, running Athena queries on S3-stored logs, or using Redshift Spectrum for analytics, migrating to R2 breaks those pipelines. Replicating them with Cloudflare Workers or external services adds complexity and latency you may not want.
Run the numbers: which workload profiles actually save with R2
The critical metric is your egress-to-storage ratio. A company with 10TB of storage and 50TB of monthly egress pays approximately $730/month on S3 vs $150/month on R2. That's $6,960 in annual savings. If your egress hits 100TB monthly, savings jump to $10,500/year.
| Company profile | Monthly storage | Monthly egress | S3 cost (estimate) | R2 cost | Annual savings |
|---|---|---|---|---|---|
| SaaS startup (user files) | 5TB | 15TB | $465/mo | $75/mo | $4,680 |
| Media company (video streaming) | 20TB | 200TB | $18,460/mo | $300/mo | $217,920* |
| ML/AI workload (public datasets) | 50TB | 150TB | $14,250/mo | $750/mo | $162,000* |
| E-commerce (product images) | 8TB | 40TB | $3,784/mo | $120/mo | $43,968* |
| Backup service (low retrieval) | 100TB | 10TB | $3,200/mo | $1,500/mo | $20,400 |
*Calculations based on public pricing from both services. Exact figures vary by region and tier.
If you transfer more than 3x your storage each month, R2 pays for itself immediately. If your ratio is below 1x (you archive more than you serve), R2's advantage shrinks but still exists due to 35% savings on base storage ($0.015 vs $0.023 per GB-month).
For B2B SaaS with users downloading reports, exported dashboards, or backups: calculate your egress over the past 3 months in S3 CloudWatch. If it exceeds 30TB monthly, you're losing more than $200/month on fees that R2 eliminates. For media companies serving video or audio, the savings can fund hiring 2-3 additional engineers per year.
Here's the methodology: pull your S3 billing data, isolate the data transfer out line item, divide by your average monthly storage. If that ratio is above 2.0, you have a strong ROI case for R2. If it's below 0.5, the migration effort may not be worth marginal savings. If I had to bet, most teams discover they're in the 1.5-3.0 range—right where R2 shines.
When S3's premium is worth paying
Let's cut through the noise: despite cost savings, S3 maintains structural advantages that justify the premium in specific cases. If your architecture depends heavily on the AWS ecosystem, migrating to R2 can cost more in re-engineering than you save on egress.
Deep AWS service integration:
If you use Lambda triggers on S3 events, Athena for SQL queries on S3-stored logs, or Redshift Spectrum for analytics, migrating to R2 breaks those pipelines. Replicating them with Cloudflare Workers or external services adds complexity and latency. 71% of developers using cloud storage choose S3 precisely for that ecosystem lock-in (Stack Overflow 2025; I don't have access to Cloudflare's internal data, so the 8.3% R2 adoption reported in the same survey is the best available proxy).
Non-negotiable compliance:
Companies in healthcare, fintech, or government cannot use R2 until it obtains HIPAA BAA, PCI-DSS Level 1, and FedRAMP. Storing PHI or payment card data on R2 is a direct regulatory violation. Cost of fines > savings on egress fees.
Low-egress workloads:
If your storage is 50TB but you only serve 5TB monthly (0.1x ratio), R2's savings are marginal. You pay $1,265/month on S3 vs $825/month on R2 ($5,280/year savings). If your team must learn a new tool, migrate data, and maintain two systems, the ROI is questionable.
Advanced features you can't replicate:
Object Lock for WORM compliance, S3 Glacier for 10+ year archival with hour/day retrieval, S3 Inventory for auditing billions of objects. If your architecture depends on these, R2 has no equivalent. Durability SLA also differs: S3 documents 99.999999999% durability (11 nines), while R2's documentation is less specific about durability guarantees. For critical data without alternative backup, S3 offers greater confidence.
Decision framework based on lock-in:
Evaluate how many AWS services you consume that integrate with S3. If it's more than 3 (Lambda, Athena, CloudFront, Glacier, etc.), the switching cost exceeds egress savings. If your only S3 use is storing and serving static assets via CDN, R2 is a no-brainer.
The critical metric: how many engineer-days would it cost to re-implement your current pipelines without S3-native integrations? If the answer is more than 20 days, and your annual R2 savings are below $15,000, stick with S3. If your savings exceed $50,000/year (high-egress workloads like media streaming), migration justifies even significant re-architecture.
Recommended hybrid strategy: keep S3 for compliance-critical data and deeply integrated workloads. Migrate high-egress, low-compliance-risk assets (media files, public datasets, user-generated content) to R2. This captures 60-80% of potential savings without re-architecting critical systems.
