Is CloudWatch "Vended Log" cost for VPC Flow Log delivery to S3 calculated on GB before or after compression?

I can't speak to VPC Flow Logs, but we recently had that same question about WAF logs, also sent as CloudWatch Vended Logs with "Delivery to S3" (doc), gzip-compressed (relevant-ish doc).

A large event on our WAF resulted in a corresponding billing surge, and AWS support helped us to clarify: in the case of WAF, the pre-compressed log volume is billed, showing in Cost Explorer for Cloudwatch under Usage type [Region]-S3-Egress-Bytes. It doesn't seem the post-compressed logs are billed, not under Cloudwatch nor S3.

Noteworthy context: in our WAF situation, the gzip compression reached a 40× ratio, resulting in a massive difference between billed usage, and the size of gz logs reaching S3.

_

I agree the language "delivered" suggests post-compression measurements, and even more so the …-S3-**Egress**-Bytes billing Usage type. Although this might be why they associate this "Data Ingested" charge with CloudWatch and not S3 with its own ingestion costs.

Hello, It should not matter whether the data is Pre/Post compressed. S3 operates and calculates the data cost on the data it has as you already mentioned the data stored is already compressed. However, if you want to consider, you can consider it as post compressed from the cost perspective. The charge would be for per GB data in the S3 (post compressed). Hope this helps :)