Amazon S3 vs Cloudflare R2

Amazon S3

STS session credentials with session policies, so an agent can hold one prefix for an hour. Egress to the internet is billed per GB after 100 GB a month.

Cloudflare R2

Free egress and a free tier of 10 GB-month plus 1 million writes a month. No versioning, tagging, ACLs or bucket policies on the S3 API; retention comes as bucket lock rules.

Amazon S3

1. Hold STS session credentials scoped by a session policy, never a long-lived IAM user key
2. Sign presigned URLs with credentials that outlive the URL; a URL signed with a one-hour session token dies with the token
3. Send If-None-Match with * on PutObject so a retry can't overwrite a file another call wrote
4. Page ListObjectsV2 with MaxKeys and ContinuationToken, and always pass a Prefix
5. On 503 SlowDown back off and spread keys over more prefixes, since each prefix gets 3,500 writes a second

Cloudflare R2

1. Set region to auto and the endpoint to https://<account-id>.r2.cloudflarestorage.com. us-east-1 also works, other region names fail
2. Ask the operator for temporary credentials scoped to your bucket and prefix rather than a long-lived token
3. For public reads put a custom domain or an r2.dev subdomain on the bucket; presigned URLs only sign the S3 hostname
4. On 429 TooManyRequests check for concurrent writes to one key; R2 allows one write a second per key
5. Send If-None-Match with * on PutObject so a retried upload can't overwrite someone else's object