S3 without CloudFront

What's the problem

Public S3 bucket > 1 GB/day without CloudFront → main benefits are latency + GET request-cost offload (per-GB egress rates are similar — informational)

How 6WAF detects it

• The threshold and data source are stated in the description above (CloudWatch metrics / AWS API describe calls) — this is the checker logic that runs in the scan, not separate marketing copy.
• Scanning uses a read-only IAM Role you deploy yourself (CloudFormation) — 6WAF stores no credentials, and you revoke access any time by deleting the stack.
• Unit prices used for estimates have a published source and an as-of date (us-east-1 baseline) — figures are a conservative lower bound, not inflated.