Paid course streaming on AWS: CloudFront flat-rate + Signed URLs vs Bunny

The problem: deliver paid video without leaking

For a course infoproduct (540 GB library, ~897 GB/month bandwidth, ~3,000 students), two requirements travel together: deliver video fast and stop the file URL from being shared outside the platform. A CDN solves the first; signed URLs solve the second.

The math: CloudFront flat-rate vs Bunny

The models bill differently, and the crossover depends on volume:

For ~897 GB/month of delivery:
  CloudFront Pro:  ~US$27/mo  (US$15 plan + ~US$12 S3/origin)
  Bunny Standard:  ~US$46/mo
  Bunny Volume:    ~US$10/mo  (smaller network, cheap at high volume)

Tipping point: above ~2 TB/month, CloudFront flat-rate ($15/50TB) beats
almost everything — and integrates Signed URLs/Cookies natively.
S3 region trap: us-east-1 $0.023/GB vs sa-east-1 $0.0405/GB
(keeping the library in us-east-1 cuts ~43% of storage).

Low, predictable volume favors Bunny Volume; growing volume plus native protection needs favor CloudFront flat-rate. The choice is by curve, not by sticker price.

Protection: Signed URLs (and HLS vs MP4)

CloudFront Signed URLs/Cookies sign access with a key and a short expiry, so a shared link dies in minutes. For video, HLS (.ts segments + playlist) beats a single MP4: beyond adaptive bitrate, each segment is signed, making a full download harder. MP4 + Signed URL is simpler to implement but downloadable while the link lives.

The one-time transcoding cost

Converting the library to HLS carries a MediaConvert per-minute cost, charged once:

MediaConvert (order of magnitude):
  SD: ~US$0.024/min
  HD: ~US$0.048/min

Transcoding the whole library in HD (one-time): ~US$1,555
→ it's migration CAPEX, not recurring cost. Plan it in the project, not the monthly bill.

Lessons

1. CDN choice is by volume curve. Above ~2 TB/month CloudFront flat-rate wins; below, reconsider Bunny Volume.

2. Signed URLs + HLS protect better than MP4. Short-expiry signing + segmentation hinder sharing and full downloads.

3. Transcoding is one-time CAPEX. ~US$1,555 for the HD library belongs in the project budget, not as a monthly surprise.

4. Keep the library in us-east-1. S3 us-east-1 is ~43% cheaper than sa-east-1 on storage; origin latency is absorbed by the CDN.

Conclusion

Selling video means delivering fast AND protecting. CloudFront flat-rate with Signed URLs solves both in one stack and gets cheaper as the base grows; Bunny Volume still wins at low volume. Add the one-time transcoding cost to the project, store the library in the cheap region, and streaming savings stop being a guess.