A CDN invoice is a compressed story about your traffic, your contract and your configuration — told in line items designed for the vendor’s billing system, not your understanding. Learning to read it pays twice: you catch errors and drift (both real), and every line you can decode becomes a lever you can pull in cost work and renewals. Here is the decode, line by line.
The anatomy: what lines to expect
Almost every CDN invoice reduces to five families. Delivery: bandwidth (or delivered GB), usually split by region, sometimes by tier within region. Requests: per-10k or per-million counts, often split HTTP/HTTPS or by feature class. Features: line items for the paid extras — WAF, bot management, image optimization, edge compute invocations, dedicated certificates. Data services: log delivery, real-time analytics, storage. Commercial adjustments: the commit line, overage, credits, and support — frequently a percentage of everything above it. Map your own invoice to these families once, in writing; vendors name things differently, and the mapping is what makes month-to-month comparison and cross-vendor comparison possible at all. Our companion piece on invoice anatomy shows worked examples from the common formats.
Bandwidth lines: regions, tiers, units
Bandwidth is usually the biggest number and the most decodable. Check three things. Regional rates: delivery is priced per region and the spread is large — premium regions (parts of APAC, South America, India on some networks) can run several times North American/European rates — so compute your blended rate (total bandwidth cost ÷ total GB) and per-region effective rates, and compare them against the rate card in your contract, not against memory; regional mix drift is the most common silent cost growth, and it is a traffic fact, not a billing error. Tier boundaries: volume tiers should show marginal pricing kicking in as contracted — verify the tier math the first month and after every renegotiation, because tier misconfiguration in billing systems is rare but real, and only visible to a customer who checks. Units: confirm GB vs GiB and delivered-vs-billed definitions (some platforms bill request+response bytes, some include TLS overhead) — unit definitions are why two CDNs’ “same” traffic differs by several percent, a gap that matters at commit-tier boundaries.
The non-bandwidth lines that grow quietly
The lines that surprise teams are rarely bandwidth. Requests: cheap per unit and enormous in count — small-object-heavy estates (APIs, tiles, LL-HLS parts) can see request fees rival bandwidth; a rising requests-to-GB ratio is a configuration signal, not just a cost one. Logs: per-GB log delivery on a chatty estate is a real line — and one you control completely via sampling and field selection, per the logging guide. Feature meters: edge-compute invocations, image transformations, WAF requests — each priced per use, each capable of quiet growth when a config change routes more traffic through them; tie each feature line to the config that drives it so growth has an owner. Support-as-percentage deserves particular attention: a support line calculated on total spend rises automatically with every other line — it is the only line item that grows without anything changing, worth knowing at renewal time. And overage: anything billed above commit at the overage rate is either a forecasting miss or a growth fact — either way it feeds directly into commit sizing.
Reconcile against your own numbers
Trust arrives through reconciliation: monthly, compare the invoice’s headline quantities against your own measurements — delivered bytes and request counts from your edge logs or the platform’s analytics API, per hostname, summed per region where your logging supports it. Expect small, stable deltas (unit definitions, sampling, timing boundaries at month edges) and document the expected delta the first time; what you are hunting is change in the delta, which means a definition changed, a logging pipeline broke, or a billing error appeared. Reconciliation is also what makes disputes fast: a discrepancy raised with your own per-day, per-hostname numbers attached resolves in one email; the same discrepancy raised as a feeling resolves at the vendor’s pace. The log fields that make this possible are the same ones the log-line guide tells you to keep.
The monthly fifteen-minute review
Turn the decode into a habit small enough to survive: fifteen minutes, same dashboard, every invoice. The six numbers: total vs last month and vs forecast; blended per-GB rate (drift means regional mix or tier position moved); requests-to-GB ratio (config smell detector); each feature line vs the config that drives it; overage (any amount → a note into the commit file); and the reconciliation delta (stable?). Anything that moved gets one sentence of explanation in the review note — traffic event, config change, price change, unknown — and “unknown” is the trigger word for a real look. Twelve of these notes make renewal prep nearly free, feed the spend forecast with honest history, and mean the annual review reads a year of small explanations instead of reconstructing one big mystery.