Origin Shield is different than that of AWS shield You can use lambda@edge for interferring request and perform compression, and image transformation gp2 to gp3 for lesser cost and guaranteed iops baseline if different aws regions, use s3, else use ssm param store