S3 + Athena for Cloudflare Logs: Is It Overkill for Startups?
Ask how to keep Cloudflare logs long-term and someone will say: “Logpush to S3, query with Athena.”
It’s a solid architecture. The AWS bill is surprisingly small. But the bill isn’t what makes it expensive.
Prerequisite: Cloudflare Enterprise
Logpush for HTTP request logs is Enterprise-only. If you’re on Free, Pro, or Business, this architecture isn’t available to you at all. Your options are the analytics API and its retention limits.
Everything below assumes you’re on Enterprise.
The architecture
- Logpush job sends gzipped log files to an S3 bucket
- S3 bucket with a bucket policy allowing Cloudflare to write, plus an ownership challenge to prove it’s yours
- Lifecycle rules to move old data to cheaper storage classes (or delete it)
- AWS Glue table (or a manual
CREATE EXTERNAL TABLE) describing the log schema - Partitioning by date so queries don’t scan everything
- Athena workgroup with query limits and a results bucket
- IAM roles for whoever runs queries
What it costs to run
Prices: S3 Standard $0.023/GB-month (us-east-1, first 50 TB), Athena $5 per TB scanned.
Assume 1 billion requests per month, ~1 KB per log line (1 TB raw), and roughly 10x gzip compression (~100 GB stored per month). Measure your own ratio; it depends on the fields you enable.
| After | Data stored | S3 storage / month |
|---|---|---|
| 1 month | ~100 GB | ~$2.30 |
| 12 months | ~1.2 TB | ~$28 |
| 24 months | ~2.4 TB | ~$55 |
Athena charges on bytes scanned, which with gzipped JSON means the compressed size:
| Query | Data scanned | Cost |
|---|---|---|
| One day, partitioned | ~3.3 GB | ~$0.02 |
| One month, partitioned | ~100 GB | ~$0.50 |
| Full year, unpartitioned | ~1.2 TB | ~$6 |
The honest verdict: The AWS bill for this setup is tiny. Anyone who tells you S3 + Athena is expensive to run is wrong.
What it costs to build and own
The real cost is engineering time.
The initial build — a few days to a sprint:
- Bucket policy and ownership challenge
- Choosing Logpush fields (you can’t add fields to logs you’ve already stored)
- Writing and testing the table schema
- Partition projection or a partition-loading job
- Lifecycle and encryption settings
The ongoing ownership:
- Schema drift. Cloudflare adds fields; your table definition doesn’t know about them.
- Silent failures. If the Logpush job breaks (rotated credentials, changed bucket policy), you find out when the data is missing.
- Query skills. Every investigation needs someone who knows the table, the partitions, and Presto SQL.
- Unpartitioned mistakes. One
SELECT *over the full history and your “cheap” query scans a terabyte.
At a loaded engineering cost of $100+/hour, a single sprint costs more than a decade of S3 storage.
The R2 variation
Logpush can also deliver to Cloudflare R2: $0.015/GB-month with no egress fees. It’s cheaper to store and keeps everything on Cloudflare, but you still need a query layer, and the ownership work above doesn’t change.
When S3 + Athena is the right call
- You’re on Enterprise and need raw, unsampled request logs
- You have a data or platform team that already runs AWS analytics
- Compliance requires logs in your own account
When it’s overkill
- You’re a small team without a data engineer
- You need trends and investigations, not per-request forensics
- You’re not on Enterprise, in which case it isn’t an option anyway
Compare this with the SIEM route in Datadog for Cloudflare logs: real costs.
Skip the build
MetricKeeper archives your Cloudflare analytics without buckets, schemas, or IAM. Connect a read-only token, choose your zones, and start building history today.