If I follow what you're saying I suppose my understanding could be wrong, but there's no "cloud transfer" required. It's just a matter of both the distribution and the configured origin being on AWS. If the origin doesn't direct traffic outside of the datacenter, AWS doesn't bill that as egress to whoever owns the origin. The Cloudfront distribution, on the other hand, will take the hit once it exceeds the free tier because it's the AWS service distributing data to end-users. It has to make a request to the AWS internal service then cache it, so The SaaS lambda or s3 bucket or EC2 instance or whatever they're using is none-the-wiser. It's just how the AWS billing mechanism works.