Published on Jun 25, 2025
Amazon CloudFront pricing changed significantly in November 2025. AWS introduced flat-rate plans — starting at $0/month — that bundle CDN delivery, WAF, DDoS protection, DNS, and edge compute into a single predictable price. This guide covers both models: the new flat-rate plans and the traditional pay-as-you-go pricing, with full rate tables, regional breakdowns, and cost optimization tactics to help you choose the right option and avoid surprises on your bill.
CloudFront cost surprises are one of the most common issues we encounter during AWS infrastructure audits at Perfsys — usually caused by misconfigured Price Classes, unreviewed pay-as-you-go features, or missing cache optimization.
Amazon CloudFront is AWS's content delivery network. It routes requests to the nearest of 600+ global edge locations, serving cached content from the edge rather than round-tripping to your origin server. This reduces latency for static assets like images and JavaScript, but also for dynamic content and APIs — CloudFront maintains persistent connections to your origin over AWS's private network, which is consistently faster than the public internet.
CloudFront integrates natively with S3, EC2, ALB, and API Gateway . Data transferred from any of those AWS origins to CloudFront is free, which makes it one of the most cost-efficient CDN setups available when you're already on AWS. Beyond performance, CloudFront provides SSL/TLS termination at the edge, geo-restriction controls, DDoS absorption, and optional WAF rule enforcement — all of which are now bundled into flat-rate plans by default.
As of 2026, Amazon CloudFront offers three pricing models:
Flat-rate plans — a fixed monthly price that bundles CloudFront CDN, AWS WAF, DDoS protection, Route 53 DNS, CloudWatch Logs, a TLS certificate, serverless edge compute, and S3 storage credits. No overage charges, even during traffic spikes or DDoS attacks. Available in four tiers.
Pay-as-you-go — the original model. You pay per GB of data transferred out, per 10,000 requests, and separately for each additional feature you enable. More flexible and still the right choice for certain workloads, but costs vary month to month.
Private Pricing Agreements (PPA) — custom rates negotiated directly with AWS for customers committing to 10 TB/month or more over a 12-month term. Best economics at high volume.
Launched in November 2025, flat-rate plans are the right starting point for most new distributions. Each plan covers one CloudFront distribution with up to one apex domain.
All plans include always-on DDoS protection, a free TLS certificate, CloudFront Functions, and Route 53 DNS. Blocked DDoS traffic and WAF-blocked requests never count against your usage allowance. When you exceed a plan's allowance, AWS reduces performance (serving from fewer or more distant edge locations) rather than charging overages.
See the full feature comparison on the official AWS CloudFront pricing page .
Important limitation: flat-rate plans do not support Lambda@Edge, real-time logs (Kinesis-based), Dedicated IP SSL, or field-level encryption. If your architecture depends on any of these features, you must stay on pay-as-you-go.
In most greenfield projects we set up for clients, the Pro plan at $15 covers everything needed for the first 6–12 months of growth — and the bundled WAF alone typically justifies the cost compared to enabling it separately on pay-as-you-go.
Pay-as-you-go is CloudFront's traditional model and still the right choice for workloads that need advanced features or have highly variable traffic. All rates below are for the US/Europe region (the cheapest). See the regional breakdown section below for other regions.
Data transfer out is the data CloudFront sends from edge locations to your end users — typically the largest line item on any CloudFront bill. Pricing is tiered: the more you transfer, the lower the per-GB rate. The first 1 TB/month is always free; after that, US/EU rates start at $0.085/GB and drop to $0.020/GB at petabyte scale.
Data transferred into CloudFront — and from any AWS origin (S3, EC2, ALB, API Gateway) to CloudFront edge locations — is free. This makes the CloudFront + S3 combination particularly cost-efficient: you pay only for the outbound delivery to your users, not for the origin leg.
Every request CloudFront processes incurs a charge, billed per 10,000 requests. HTTPS requests cost ~33% more than HTTP due to TLS overhead. The first 10 million requests per month are free under the always-free tier. For pay-as-you-go customers in US/Europe: $0.0075/10k for HTTP, $0.0100/10k for HTTPS.
CloudFront data transfer costs vary significantly by the region serving your end users. The first 1 TB/month is free across all regions. Rates below are for the next 9 TB tier — the first paid tier most customers hit.
Always verify current rates on the AWS CloudFront pay-as-you-go pricing page , as regional rates are updated periodically.
Price Classes let you limit which edge locations CloudFront uses, trading a small amount of latency for lower costs. There are three options:
Price Class All — all global edge locations. Best performance, highest potential cost.
Price Class 200 — US, Europe, Middle East, Africa, and Asia-Pacific (excludes South America). Useful if you have no meaningful traffic from South America.
Price Class 100 — US, Canada, Mexico, and Europe only. Caps your per-GB rate at $0.085 regardless of where a request is occasionally served from.
Price Class misconfiguration is one of the most consistent findings in our AWS Cloud Assessment — clients paying Asia-Pacific or South American edge rates for traffic that is 90%+ US and European. It's a one-click fix in the console that can cut a meaningful percentage off a monthly bill immediately.
If your analytics show 90%+ of traffic from North America and Europe, Price Class 100 is an easy, low-risk cost reduction. You configure it directly in the AWS CloudFront console under your distribution settings.
When content needs updating or removal from the cache, invalidation requests are necessary. The first 1,000 invalidation paths per month are free; subsequent paths cost $0.005 each. Plan content deployments to batch invalidations rather than triggering them individually — a single wildcard path (e.g. /images/*) counts as one path regardless of how many files it matches.
CloudFront's field-level encryption allows sensitive data — such as payment details or personal identifiers — to be encrypted at the edge before it reaches your origin. It costs $0.02 per 10,000 requests on top of the standard HTTPS fee. This is a pay-as-you-go-only feature and is particularly relevant for workloads subject to GDPR or HIPAA requirements.
Origin Shield adds a centralized caching layer between CloudFront's regional edge caches and your origin. It reduces duplicate origin fetches, which lowers load on your origin infrastructure. The cost is $0.0075 per 10,000 requests for the US region. A rough rule of thumb: approximately 10% of your HTTPS requests will reach Origin Shield, so at 200M requests/month, expect around $15/month in Origin Shield fees.
Both let you run code at the edge, but they serve different use cases — and have a significant price gap:
CloudFront Functions — $0.10 per 1M invocations. Lightweight JavaScript only. Best for URL rewrites, cache-key normalization, and header manipulation. 2M invocations/month are free.
Lambda@Edge — $0.60 per 1M requests plus duration charges ($0.00000625125 per 128 MB-second). Full Node.js/Python environment with network access and AWS SDK. Use it when you need logic that CloudFront Functions can't handle — origin selection, A/B testing with external state, or complex request transformation. No free tier.
The cost difference is 6× on requests alone, and widens further once you add Lambda@Edge duration charges. In our experience, the majority of edge logic that clients initially scope for Lambda@Edge can be handled by CloudFront Functions once the use case is properly defined — origin selection and complex A/B testing with external state are the main exceptions. If CloudFront Functions can handle your use case, it should.
Amazon's AWS Pricing Calculator lets you input your expected data transfer volumes, request counts, edge compute usage, and region distribution to get an estimated monthly cost. It supports both flat-rate and pay-as-you-go scenarios.
Run multiple scenarios — model your average month, your peak month, and a DDoS-spike scenario. The difference between flat-rate and pay-as-you-go often becomes clear at around 5–10 TB/month of data transfer.
If you're on pay-as-you-go with consistent month-to-month usage, the CloudFront Savings Bundle gives you up to 30% off your entire CloudFront bill in exchange for a one-year monthly spend commitment. The discount applies to all CloudFront usage types — data transfer, requests, CloudFront Functions, and Lambda@Edge. It also includes free AWS WAF usage up to 10% of your committed amount. For teams with predictable traffic who aren't ready to switch to flat-rate plans, this is typically the first recommendation we make after a CloudFront cost audit (part of our Cloud Assessment) — it requires no architecture changes and no migration risk, just a spend commitment you'd likely make anyway.
Proper cache configuration is the highest-leverage cost lever on pay-as-you-go. Every cache hit means one fewer origin fetch and one fewer billable request to your backend. Set appropriate TTLs on your objects — long TTLs for versioned assets (images, JS bundles with hashed filenames), shorter TTLs for HTML. Use cache control headers rather than relying on CloudFront defaults.
If your audience is concentrated in the US and Europe, switching to Price Class 100 immediately caps your data transfer rate at $0.085/GB. Check your CloudFront access logs or analytics for the geographic distribution of your traffic before making this change.
Set up AWS Budgets with alerts at 80% and 100% of your expected monthly CloudFront spend. CloudFront's built-in usage reports in the console show data transfer, request counts, and cache hit ratios broken down by distribution and time period — review these monthly to catch unexpected spikes before they hit your bill.
Amazon CloudFront pricing in 2026 offers more flexibility than ever: a $0/month flat-rate plan that includes WAF and DDoS protection for small workloads, a $15/month Pro plan that provides 50 TB of data transfer (worth ~$4,250 at pay-as-you-go rates), and a fully granular pay-as-you-go model for workloads that need Lambda@Edge, real-time logs, or advanced SSL features.
The right choice depends on your traffic volume, feature requirements, and tolerance for billing variability. Use the AWS Pricing Calculator to model your specific workload before committing to a model.
If you need help architecting a cost-efficient CloudFront setup as part of a broader AWS infrastructure , the Perfsys team can help.
Ready to optimize your Amazon CloudFront costs and enhance your content delivery strategy? Look no further than Perfsys. Our team of certified AWS experts specializes in providing cost-effective consulting, development, and support services to startups and small to medium-sized businesses. We are committed to helping you build robust MVPs, reduce cloud expenses, and scale your operations securely.
Eugene Orlovsky
CEO & Founder | Serverless architect with 10+ years of hands-on experience designing cloud-native architectures on AWS, backed by multiple AWS certifications. He is writing bridges deep technical expertise with real-world business strategy, covering topics from AWS best practices to scaling tech-driven organizations.
85%
Reduction in form creation time
3×
Faster grant application completion
3
months full platform delivery
Perfsys built four AI services for EPIRA.ai on AWS Bedrock, automating grant form creation (80–90% faster) and pre-application eligibility scoring. Delivered in 3 months by 2 engineers with a fully serverless, scalable architecture.
4
Sub-brands unified under one login
2–3×
Faster onboarding of new products
35%
Fewer login-related support requests
Perfsys designed and implemented a customized Keycloak SSO solution aligned with the client's AWS architecture and business requirements. The customer gained a secure, reliable identity management setup that improved access control, simplified authentication, and supported efficient cloud operations.
Need to move fast? Our cloud team is ready to scale, secure, and optimize your systems. Get serverless expertise, 24/7 support, and seamless CI/CD pipelines when you need it most.
