AWS S3 vs Cloudflare R2: Object Storage Compared
TL;DR
Cloudflare R2 eliminates egress fees entirely. AWS S3 charges $0.09/GB after the first 100GB free each month. For a workload serving 10TB monthly, that difference is $891/month in egress alone — $10,692/year. R2 also stores data at $0.015/GB versus S3's $0.023/GB, making it 35% cheaper per gigabyte before egress enters the equation.
S3 wins on enterprise depth: 6+ storage classes including Glacier Deep Archive at $0.00099/GB, Object Lock for WORM compliance, HIPAA/FedRAMP/PCI DSS certifications, and native integration with the entire AWS ecosystem. For teams already running on AWS with compliance requirements or complex event-driven architectures, S3 remains the only option. For teams serving content to end users — media, static assets, CDN origins, API payloads — R2 delivers the same S3-compatible functionality at a fraction of the cost.
Key Takeaways
- R2 egress is $0. S3 egress is $0.09/GB. For 10TB of monthly egress, R2 saves $891/month — $10,692/year in data transfer costs alone.
- R2 storage is $0.015/GB. S3 Standard is $0.023/GB. R2 is 35% cheaper per gigabyte stored, before egress savings factor in.
- S3 offers 6+ storage classes. Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Flexible Retrieval, and Glacier Deep Archive. R2 offers two: Standard and Infrequent Access.
- S3 has Object Lock (WORM compliance). Required for immutable storage in regulated industries. R2 does not support Object Lock.
- S3 holds deeper compliance certifications. HIPAA, FedRAMP, PCI DSS, SOC 1/2/3, and ISO 27001. R2 has SOC 2 Type II and ISO 27001.
- R2 uses the S3 API. Migration from S3 to R2 is a configuration change — swap the endpoint URL and credentials. No SDK or code changes needed.
- R2 includes a permanent free tier. 10GB storage, 1 million Class A operations, 10 million Class B operations per month. S3's free tier expires after 12 months.
- The 2026 pattern: Egress-heavy workloads default to R2. Enterprise workloads with AWS ecosystem dependencies and compliance needs stay on S3. Many teams use both.
The Egress Problem
AWS S3 launched in 2006 and became the default object storage for the internet. Every major framework, SDK, and cloud tool integrates with S3. "S3-compatible" is an industry standard. The API is the de facto specification for object storage.
But S3 has an economic problem: egress pricing.
Storing 1TB on S3 Standard costs $23/month. Downloading that 1TB costs $90 in egress fees — nearly 4x the storage cost. For workloads that serve data to users — images on a website, video on a platform, files from an API — egress becomes the dominant line item on the AWS bill. The more successful the application, the more painful the egress tax.
Cloudflare R2 launched in 2022 with one structural advantage: zero egress fees. Not a free tier. Not a promotional rate. Zero, permanently, for all data downloaded through any access method — S3 API, Workers binding, or public URL. Storage costs $0.015/GB, 35% less than S3 Standard. The S3-compatible API means existing code works with a configuration change.
The tradeoff is real. R2 has two storage classes to S3's six-plus. R2 lacks Object Lock, S3 Select, and the compliance certifications that regulated industries require. S3's integration with Lambda, EventBridge, Athena, and the broader AWS ecosystem has no equivalent on R2. The question is whether a given workload needs those enterprise features — or needs lower costs.
Feature Comparison
| Feature | Cloudflare R2 | AWS S3 |
|---|---|---|
| Egress cost | $0 (always) | $0.09/GB (after 100GB free) |
| Storage cost/GB | $0.015 | $0.023 |
| Storage classes | 2 (Standard, Infrequent Access) | 6+ (Standard, IA, Glacier, Deep Archive, etc.) |
| S3 API compatible | Yes | Yes (native) |
| Max object size | 5TB | 5TB |
| Versioning | Yes | Yes |
| Object lifecycle rules | Basic (IA transition, expiration) | Advanced (multi-class transitions, analytics) |
| Object Lock (WORM) | No | Yes |
| Encryption at rest | Yes (default, AES-256) | Yes (SSE-S3, SSE-KMS, SSE-C) |
| Encryption in transit | Yes (TLS) | Yes (TLS) |
| Access control | Bucket-level policies, API tokens | IAM policies, bucket policies, ACLs, Access Points |
| Event notifications | Workers integration | EventBridge, SNS, SQS, Lambda |
| Replication | Automatic multi-region | Cross-region and same-region (configurable) |
| S3 Select (query in place) | No | Yes |
| Batch operations | Limited | Yes (S3 Batch Operations) |
| CDN integration | Native (Cloudflare CDN, included) | CloudFront (separate service, separate pricing) |
| Presigned URLs | Yes | Yes |
| Multipart upload | Yes | Yes |
| HIPAA compliance | No | Yes |
| FedRAMP | No | Yes |
| PCI DSS | No | Yes |
| SOC 2 Type II | Yes | Yes |
| ISO 27001 | Yes | Yes |
| Free tier | 10GB storage, 1M writes, 10M reads/month (permanent) | 5GB, 20K GET, 2K PUT (12 months only) |
R2 wins on cost and CDN integration. S3 wins on storage tiering, compliance, enterprise features, and ecosystem depth.
Pricing Breakdown
Cloudflare R2 Pricing
| Component | Standard | Infrequent Access |
|---|---|---|
| Storage | $0.015/GB/month | $0.01/GB/month |
| Class A operations (writes) | $4.50/million | $9.00/million |
| Class B operations (reads) | $0.36/million | $0.90/million |
| Data retrieval | $0 | $0.01/GB |
| Egress | $0 | $0 |
| Free tier | 10GB storage, 1M Class A, 10M Class B/month | -- |
Zero egress applies to every access method: S3 API, Workers binding, and r2.dev public URLs. No tiers, no caps, no fine print.
AWS S3 Pricing (US East - N. Virginia)
| Component | Standard | Standard-IA | Glacier Flexible | Glacier Deep Archive |
|---|---|---|---|---|
| Storage (first 50TB) | $0.023/GB/month | $0.0125/GB/month | $0.0036/GB/month | $0.00099/GB/month |
| PUT/POST requests | $5.00/million | $10.00/million | $30.00/million | $50.00/million |
| GET requests | $0.40/million | $1.00/million | $10.00/million | $10.00/million |
| Retrieval fee | $0 | $0.01/GB | $0.03/GB | $0.02/GB |
| Egress (first 100GB) | Free | Free | Free | Free |
| Egress (100GB-10TB) | $0.09/GB | $0.09/GB | $0.09/GB | $0.09/GB |
| Egress (10TB-50TB) | $0.085/GB | $0.085/GB | $0.085/GB | $0.085/GB |
S3's first 100GB of egress per month is free, aggregated across all AWS services. Beyond that, egress is the dominant cost for read-heavy workloads.
Real-World Cost Scenarios
| Scenario | R2 Monthly | S3 Standard Monthly | Annual Savings with R2 |
|---|---|---|---|
| 100GB stored, 500GB egress | $1.50 | $47.30 | $550 |
| 500GB stored, 2TB egress | $7.50 | $182.50 | $2,100 |
| 1TB stored, 5TB egress | $15 | $473 | $5,496 |
| 5TB stored, 10TB egress | $75 | $1,006 | $11,172 |
| 10TB stored, 10TB egress | $150 | $1,121 | $11,652 |
| 10TB stored, 50TB egress | $150 | $4,730 | $54,960 |
| 100TB stored, 100TB egress | $1,500 | $11,300 | $117,600 |
A SaaS platform storing 1TB and serving 5TB of downloads monthly pays $15/month on R2 versus $473/month on S3 Standard. That is a 97% cost reduction. A media platform serving 50TB/month from 10TB of stored content saves $54,960/year by switching to R2.
Where S3 Wins on Storage Cost
S3's archival tiers remain unmatched for cold data:
| Storage Class | Cost/GB/Month | Use Case |
|---|---|---|
| S3 Glacier Flexible Retrieval | $0.0036 | Backups, compliance archives (minutes-to-hours retrieval) |
| S3 Glacier Deep Archive | $0.00099 | Long-term regulatory retention (12-48 hour retrieval) |
| R2 Standard | $0.015 | General-purpose storage |
| R2 Infrequent Access | $0.01 | Less frequently accessed objects |
Glacier Deep Archive is 15x cheaper than R2 Standard for data that does not need fast retrieval. Organizations archiving petabytes of regulatory data save substantially by using S3's deepest tiers. R2 has no equivalent to Glacier.
Storage Classes
S3: Six-Plus Tiers for Every Access Pattern
S3 offers a graduated system designed to match storage cost to access frequency:
- S3 Standard — Hot data accessed frequently. $0.023/GB.
- S3 Intelligent-Tiering — Automatic tier migration based on access patterns. Moves objects between frequent, infrequent, and archive tiers without retrieval fees. Small monthly monitoring charge per object.
- S3 Standard-IA — Infrequently accessed data that still requires millisecond retrieval. $0.0125/GB with per-GB retrieval fee.
- S3 One Zone-IA — Same as Standard-IA but stored in a single availability zone. $0.01/GB. Lower durability guarantee (99.5% availability vs 99.9%).
- S3 Glacier Flexible Retrieval — Archive storage with retrieval times from minutes to hours. $0.0036/GB.
- S3 Glacier Deep Archive — Cheapest storage tier. Retrieval in 12-48 hours. $0.00099/GB.
S3 lifecycle policies automate transitions between tiers. Objects can move from Standard to IA after 30 days, then to Glacier after 90, then to Deep Archive after 365 — all configured declaratively.
R2: Two Tiers, Simpler Model
R2 offers two storage classes:
- R2 Standard — General-purpose. $0.015/GB. No retrieval fee.
- R2 Infrequent Access — Less frequently accessed objects. $0.01/GB. $0.01/GB retrieval fee. Minimum storage duration of 30 days.
Lifecycle rules support transitioning objects from Standard to Infrequent Access and automatic expiration. The model is simpler but lacks the deep archival tiers that S3 provides.
For workloads that need long-term cold storage at sub-penny-per-GB pricing, S3 Glacier remains the only option among these two platforms.
S3 API Compatibility
R2 implements the S3 API. The same SDKs, the same CLI tools, the same integration libraries work with R2 by changing the endpoint URL and credentials. No code refactoring required.
Node.js example — identical code for both platforms:
import { S3Client, PutObjectCommand, GetObjectCommand } from '@aws-sdk/client-s3';
// S3 configuration
const s3 = new S3Client({
region: 'us-east-1',
credentials: {
accessKeyId: process.env.AWS_ACCESS_KEY,
secretAccessKey: process.env.AWS_SECRET_KEY,
},
});
// R2 configuration — same SDK, different endpoint
const r2 = new S3Client({
region: 'auto',
endpoint: 'https://ACCOUNT_ID.r2.cloudflarestorage.com',
credentials: {
accessKeyId: process.env.R2_ACCESS_KEY,
secretAccessKey: process.env.R2_SECRET_KEY,
},
});
// Upload — same call for both
await client.send(new PutObjectCommand({
Bucket: 'my-bucket',
Key: 'assets/logo.png',
Body: fileBuffer,
ContentType: 'image/png',
}));
// Download — zero egress on R2, $0.09/GB on S3
const { Body } = await client.send(new GetObjectCommand({
Bucket: 'my-bucket',
Key: 'assets/logo.png',
}));
R2's Workers integration adds a dimension S3 cannot match. Objects stored in R2 are directly accessible from Cloudflare Workers running at the edge — no network hop, no egress, no additional latency:
// Cloudflare Worker with R2 binding — edge-native storage access
export default {
async fetch(request, env) {
const url = new URL(request.url);
const key = url.pathname.slice(1);
const object = await env.MY_BUCKET.get(key);
if (!object) return new Response('Not Found', { status: 404 });
return new Response(object.body, {
headers: {
'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
'Cache-Control': 'public, max-age=86400',
},
});
},
};
This pattern enables image transformation, access control, and dynamic content generation at the edge — all without egress fees.
Migration: S3 to R2
Cloudflare provides Super Slurper, a migration tool that copies data from any S3-compatible source incrementally. Migration runs alongside production traffic.
Steps:
- Create an R2 bucket in the Cloudflare dashboard
- Configure Super Slurper with S3 credentials and bucket details
- Start incremental migration (runs in background)
- Update application endpoint URL and credentials
- Verify data integrity and cut over
Because the API is identical, application-level changes are minimal. Most migrations require changing two environment variables: the endpoint URL and the access credentials.
Enterprise Features
S3's enterprise feature set reflects two decades of development for regulated industries. These capabilities have no equivalent on R2.
Object Lock (WORM Compliance)
S3 Object Lock provides write-once-read-many storage. Once an object is locked, it cannot be deleted or overwritten for a specified retention period — even by the root account. This is required for SEC Rule 17a-4, FINRA, and CFTC compliance in financial services.
R2 does not support Object Lock.
Compliance Certifications
| Certification | AWS S3 | Cloudflare R2 |
|---|---|---|
| HIPAA | Yes (with BAA) | No |
| FedRAMP High | Yes | No |
| PCI DSS Level 1 | Yes | No |
| SOC 1 Type II | Yes | No |
| SOC 2 Type II | Yes | Yes |
| SOC 3 | Yes | No |
| ISO 27001 | Yes | Yes |
| ISO 27017 | Yes | No |
| ISO 27018 | Yes | No |
For healthcare (HIPAA), government (FedRAMP), and payment card (PCI DSS) workloads, S3 is the only option between these two platforms.
Event-Driven Architecture
S3 integrates natively with AWS's event routing infrastructure:
// Lambda triggered by S3 object creation
export const handler = async (event) => {
const bucket = event.Records[0].s3.bucket.name;
const key = event.Records[0].s3.object.key;
// Process uploaded file — thumbnail generation, virus scan, etc.
const { Body } = await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
const result = await processFile(Body);
await s3.send(new PutObjectCommand({
Bucket: bucket,
Key: `processed/${key}`,
Body: result,
}));
};
S3 event notifications route to Lambda, SNS, SQS, and EventBridge — enabling complex data pipelines. R2 supports event handling through Workers, but the breadth of AWS's event routing and downstream service integration is significantly deeper.
Access Control
S3's access control system includes IAM policies, bucket policies, ACLs, Access Points, and VPC endpoints. Access Points allow creating named entry points with distinct permissions — useful for multi-tenant architectures. VPC endpoints keep traffic within the AWS network.
R2 uses bucket-level policies and API tokens. Functional for most use cases but lacking the granularity of S3's IAM integration.
When to Choose Cloudflare R2
- Egress costs dominate the storage bill. Media delivery, CDN origins, public file hosting, and API payloads that serve large responses. Zero egress eliminates the cost that scales linearly with success.
- Budget predictability matters. Storage is the only variable cost on R2. Traffic spikes do not produce surprise egress bills.
- The application serves content to end users. Every byte delivered to a browser, mobile app, or API consumer is free on R2 and $0.09/GB on S3.
- Cloudflare Workers are part of the stack. Native R2 bindings enable edge processing — image resizing, PDF generation, content transformation — without egress fees.
- The workload does not need deep archival tiers or WORM compliance. Two storage classes cover the majority of hot-to-warm access patterns.
When to Choose AWS S3
- The application runs on AWS. Lambda triggers, EventBridge routing, Athena queries, and CloudFront distribution are natively integrated. Using R2 for storage in an otherwise all-AWS architecture adds operational complexity.
- Compliance requires specific certifications. HIPAA, FedRAMP, PCI DSS — S3's compliance portfolio covers regulated industries where R2 cannot operate.
- Long-term archival storage is needed. Glacier Deep Archive at $0.00099/GB is 15x cheaper than R2 Standard for data that is rarely accessed. Intelligent-Tiering automates tier transitions based on access patterns.
- Object Lock (WORM) is required. Regulatory requirements for immutable storage — financial records, legal holds, compliance archives — demand S3 Object Lock.
- Complex event-driven data pipelines are in play. S3 to EventBridge to Lambda/SNS/SQS workflows power architectures that R2's Workers-based eventing cannot replicate at the same depth.
- Fine-grained access control is necessary. IAM policies, Access Points, VPC endpoints, and cross-account access patterns require S3's access control infrastructure.
The 2026 Pattern
New projects with egress-heavy workloads increasingly default to R2. The zero-egress model has shifted developer expectations — paying per-gigabyte for data transfer is no longer accepted as inevitable. Startups and mid-size teams building content-serving applications choose R2 as the starting point and see no reason to switch.
Enterprise projects with existing AWS infrastructure, compliance mandates, or complex event-driven architectures stay on S3. The ecosystem depth, compliance portfolio, and archival tiers are not features R2 is attempting to replicate.
The two are not mutually exclusive. A growing number of teams use R2 for public-facing content delivery — images, downloads, media streams — while keeping S3 for internal data processing, compliance-bound storage, and long-term archival. The S3-compatible API makes this dual approach a configuration choice rather than an architectural one.
Methodology
- Sources: Cloudflare R2 and AWS S3 official pricing pages, Cloudflare developer documentation, AWS S3 documentation, and third-party comparisons from Vantage, DigitalApplied, Semaphore, and Pump
- Pricing data: Official pricing pages as of March 2026. S3 pricing uses US East (N. Virginia) region. R2 pricing is uniform globally
- Feature data: Official documentation from both platforms
- Limitations: S3 pricing varies by region. Enterprise or volume discounts are not reflected. Cost comparisons use standard published rates without negotiated contracts
Choosing your cloud storage stack? Compare AWS S3, Cloudflare R2, and more on APIScout -- pricing, features, and developer experience across every major storage API.