Comment by dangoodmanUT

A quick answer is to put the bucket behind cloudfront so that the denial is cached, but that's not totally free either.

If they actually charge for unauth'd requests that's absurd