AWS CloudFront pricing explained: rates, free tier and flat-rate plans

Pay-as-you-go: what you are billed for

Under pay-as-you-go, a CloudFront bill has two main lines (data transfer out and requests) and a set of optional feature charges. The pay-as-you-go price list sets the rates by viewer region, not by the AWS Region where your origin runs.

The always-free tier

Every AWS account gets these allowances each month, with no time limit:

• 1 TB of data transfer out to the internet
• 10,000,000 HTTP or HTTPS requests
• 2,000,000 CloudFront Functions invocations
• 2,000,000 CloudFront KeyValueStore reads
• 10 distribution tenants (for multi-tenant SaaS setups)
• Free public TLS certificates (through AWS Certificate Manager)

The free tier applies across the account, not per distribution or per region.

Data transfer out to viewers

This is the per-GB rate for content delivered from edge locations. It falls as monthly volume grows. Selected regions:

Two things stand out for Nordic and Indian teams. European viewers are billed at the lowest rate on the list. Indian viewers cost about 28% more per GB in the first band, and the gap widens at high volume because India's rates fall more slowly.

Requests

Requests are billed per 10,000 after the free 10 million. HTTPS costs more than HTTP:

Request charges matter most for sites with many small objects, such as API responses, thumbnails and tracking pixels. For video and large downloads, data transfer dominates.

Data transfer to your origin

Fetches from an AWS origin to CloudFront are free. Traffic going the other way (uploads through POST or PUT, and WebSocket or gRPC traffic from clients to your server) is billed at a separate rate: $0.020 per GB in Europe and North America, $0.060 in Japan and most of Asia, $0.125 in South America and $0.160 in India. Upload-heavy apps with Indian users should model this line separately.

Optional features that add cost

The $600 dedicated IP option only matters for very old clients that do not support SNI. Almost every modern browser and device supports SNI, so most teams never need it.

Flat-rate plans: what you get for a fixed monthly price

A flat-rate plan covers one distribution with up to one apex domain. You pay a fixed price and AWS does not charge overages, even during traffic spikes or DDoS attacks. Requests that AWS WAF blocks do not count against your allowance.

Every plan includes the CDN, always-on DDoS protection, AWS WAF, Route 53 DNS, a TLS certificate and serverless edge compute. Pro and above add logging (CloudWatch Logs ingestion for access and WAF logs). Business and Premium add an uptime SLA, private VPC origins and advanced DDoS protection. Premium adds Origin Shield and origin failover. Premium allowances can be raised in steps, up to 6 billion requests and 600 TB for $10,000 a month.

The allowances are not hard caps. According to the CloudFront Developer Guide, a first spike up to 3x the allowance has no effect that month. Sustained excess over two to three months can lead AWS to adjust delivery, for example by serving from fewer or more distant edge locations, until you upgrade.

Plans also exclude some features. Real-time logs, continuous deployment and staging distributions, dedicated IP SSL, field-level encryption, multi-tenant distributions, Anycast IP lists and some advanced WAF protections (account takeover and account creation fraud) all require pay-as-you-go. Plans cannot be combined with other discounts.

Which model is cheaper? Three worked examples

These examples use the published list rates above, assume all traffic goes to one region and count 1 TB as 1,000 GB, as AWS's own pricing examples do. They exclude WAF on pay-as-you-go, which is billed separately.

For a small site, pay-as-you-go is free and hard to beat. Once a single site moves terabytes a month and needs a WAF, a flat-rate plan is often far cheaper, provided you can live without the excluded features.

Pay-as-you-go still wins in some cases. One is many distributions, because each plan covers one. Another is very large, steady traffic where you can negotiate. Customers who commit to 10 TB or more per month for at least 12 months can ask AWS for custom pricing. The CloudFront Security Savings Bundle also cuts up to 30% off the bill for a one-year monthly spend commitment and includes WAF usage up to 10% of the committed amount.

How to estimate your CloudFront bill

Start from real data, not guesses. A forecast is only as good as your inputs for traffic volume, request count and viewer location.

1. Pull current usage. If you already run CloudFront, use the usage reports in the CloudFront console and filter Cost Explorer by service and usage type. Our AWS Cost Explorer guide shows how to group by usage type so data transfer and requests appear as separate lines.
2. Split traffic by viewer region. A site with 70% Nordic and 30% Indian viewers has a blended rate well above $0.085 per GB.
3. Count requests, not just bytes. Divide total requests by page views to see how many objects each page loads.
4. Model both pricing models in the AWS Pricing Calculator. Add WAF and Route 53 to the pay-as-you-go estimate so the comparison with a flat-rate plan is fair.
5. Add a budget alarm. Pay-as-you-go has no ceiling, so set an AWS Budgets alert at 80% and 100% of the expected monthly spend.

How to reduce CloudFront costs

Most savings come from sending fewer bytes and fewer requests to viewers and to your origin. Work through these in order.

Raise the cache hit ratio

Every cache miss means an origin fetch, more origin compute and slower pages. AWS's guidance on increasing the cache hit ratio starts with the cache key. Forward only the headers, cookies and query strings your origin really needs, and set long cache lifetimes for versioned static files.

Compress and resize

Turn on automatic Gzip and Brotli compression for text assets, serve modern image formats and resize images at build time or at the edge. Smaller objects cut data transfer directly.

Choose a price class

Price classes exclude the more expensive edge locations. Price Class 100 serves only from North America and Europe. Price Class 200 adds Asia, India, Japan, the Middle East and Africa but leaves out South America and Australia. If your audience is in the Nordics and India, Price Class 200 keeps Indian performance while capping the highest rates. Viewers outside the class still get content, only with more latency.

Prefer CloudFront Functions for light logic

Redirects, header rewrites and cache-key normalisation run on CloudFront Functions at $0.10 per million invocations, with 2 million free. Lambda@Edge costs six times as much per request, adds duration charges and has no free tier. Keep it for work that needs network calls or larger payloads.

Use Origin Shield only where it pays back

Origin Shield adds a central caching layer in front of your origin. It costs extra per request, so it pays off when origin load is the expensive part: live video packaging, on-the-fly image processing or an origin outside AWS.

Batch invalidations

Use versioned file names instead of invalidating on every deploy. If you do invalidate, use wildcards or cache tags so you stay inside the 1,000 free paths per month.

CloudFront compared with other CDNs

Comparing CDNs on headline price per GB is misleading, because the pricing models differ. Cloudflare sells plan-based tiers, Akamai mostly sells negotiated enterprise contracts, and Fastly, Azure Front Door and Google Cloud CDN bill on usage, each with its own fee structure. Compare quotes on your real traffic mix, not on list rates.

For a workload already on AWS, CloudFront has two cost advantages that other CDNs cannot match: free origin fetches from AWS services and the option of a flat-rate plan with WAF and DNS included. If your origin is outside AWS, or you run a multi-CDN setup, compare total cost including origin egress, security add-ons and support. A cloud cost review can model this for your traffic profile.

A real-world view: seasonal traffic

Pricing tables only tell part of the story. The architecture decides how much traffic reaches the expensive parts of your stack. When Swedish ski resort group Branäsgruppen moved from VMware to AWS with Opsio, the challenge was five months of very high seasonal traffic, including slope webcam images, on servers that had to be scaled by hand.

After a replatform onto AWS with auto-scaling and multi-AZ deployment, the Branäsgruppen case reports 40% better average page responsiveness and a 40% reduction in total cost of ownership. The same principle applies to a CDN budget: absorb peaks with caching and elastic capacity rather than paying for peak capacity all year.

How Opsio helps

Opsio is an AWS Advanced Tier Services Partner with offices in Karlstad, Sweden and Bangalore, India. As part of our AWS managed service we review CloudFront distributions and cache policies and compare pay-as-you-go with flat-rate plans per distribution. We also set budgets and alerts so CDN spend stays predictable. For broader savings, our FinOps service covers the rest of the AWS bill.

Frequently asked questions

Is AWS CloudFront free?

Partly. On pay-as-you-go, the always-free tier covers 1 TB of data transfer out, 10 million requests and 2 million CloudFront Functions invocations each month, indefinitely. There is also a $0 flat-rate Free plan with 100 GB and 1 million requests. Usage above the free tier is billed.

How much does CloudFront cost per GB?

After the free 1 TB, data transfer to viewers in Europe and North America costs $0.085 per GB for the next 9 TB and falls to $0.020 per GB above 5 PB. India starts at $0.109 per GB, Japan and Australia at $0.114, and Hong Kong and Southeast Asia at $0.120.

Is CloudFront cheaper than serving directly from S3 or EC2?

Usually, yes. Data transfer from AWS origins to CloudFront is free, so you swap the origin's internet egress charge for CloudFront's rate, and AWS's own pricing examples show this saving. Caching also cuts the number of S3 GET requests and the compute load on EC2 or containers. Run both options in the Pricing Calculator for your regions.

Does CloudFront charge for data transfer from S3?

No. Origin fetches from any AWS origin, including S3, EC2, Elastic Load Balancing and private VPC origins, are free. You still pay S3's own storage and request charges, and you pay CloudFront's data transfer out to viewers.

Should I use a flat-rate plan or pay-as-you-go?

Choose a flat-rate plan when one site moves a predictable amount of traffic and needs WAF and DDoS protection, and you want a fixed bill. Choose pay-as-you-go when you need excluded features such as real-time logs, staging distributions or dedicated IP SSL, when you run many distributions, or when you qualify for committed-use discounts.

What happens if I exceed a flat-rate plan's allowance?

You are not charged overages. A first spike up to three times the allowance has no effect that month. If usage stays well above the allowance for several months, AWS may adjust delivery, such as serving from fewer edge locations, until you move to a higher tier.