Amazon CloudFront pricing

CloudFront pricing is a price per GB the edge locations deliver to viewers, tiered by monthly volume and by the world region of the location, a price per 10,000 HTTP or HTTPS requests, a price per GB back to the origin on writing requests, and extra items for Origin Shield, CloudFront Functions, Lambda@Edge, invalidations, real-time logs and dedicated certificates; since 2025 there are flat-rate plans with a fixed monthly price beside them. On the bill, data transfer to viewers dominates on almost every distribution, and requests become the second line only with many small objects.

Pricing dimensions

CloudFront prices the delivery, not the distribution: a distribution without traffic costs nothing, and every item grows with what the edge locations actually send to viewers. The prices differ by the world region of the edge location that delivers the response, not by the origin's region, and every item carries its own usage type.

Data transfer to viewers is the dimension that makes a distribution's price, and it is tiered in two directions: the tiers lower the GB price with monthly volume, and the world region of the edge location sets the base price, lowest in North America and Europe, considerably higher in South America, India and Australia. A distribution's price class limits which locations it uses: Price Class 100 delivers only from the cheapest world regions, North America and Europe, Price Class 200 adds Asia and others, Price Class All uses every location; whoever chooses a lower class serves viewers in other world regions from Europe or North America, with more latency, but at that price. The free allowance of 1 TB of data transfer, 10 million requests and 2 million CloudFront Functions executions a month does not expire.

What CloudFront does not charge is the path from the origin to the edge: cache misses that fetch objects from S3, an instance or a load balancer produce no data transfer, neither at CloudFront nor at the origin. That is why a distribution in front of a bucket is cheaper than the bucket alone, even without cache hits: the transfer S3 charges to the internet at USD 0.09 per GB is replaced by transfer from CloudFront at USD 0.085 per GB, and every cache hit relieves the requests at the origin on top. Origin Shield adds a cache layer in an AWS region shared by all edge locations and costs per 10,000 requests that pass through it; it pays off when the origin charges requests dearly or many locations fetch the same object.

Since November 2025 AWS has offered flat-rate plans per distribution: Free at USD 0, Pro at USD 15, Business at USD 200 and Premium at USD 1,000 a month, each with published usage allowances and no overage charges on exceeding them; a plan bundles CloudFront, AWS WAF and DDoS protection, Route 53, CloudWatch Logs ingestion, edge functions and S3 credits into one monthly price. AWS states that a first spike up to three times the allowance is carried in the month and only sustained excess leads to an adjustment. For a distribution with steady traffic the plan is an arithmetic against the sum of transfer, requests and WAF fees; for one with rare spikes it is insurance.

How it appears in your billing data

In the Cost and Usage Report the lines carry the product code AmazonCloudFront and lineItem/ResourceId the distribution's ARN, and the usage type carries as prefix not an AWS region but the world region of the edge location: EU for Europe, US for North America, AP for Asia, JP for Japan, SA for South America. Data transfer to viewers appears as EU-DataTransfer-Out-Bytes, with the tiers as separate lines and split into EU-Out-Bytes-HTTPS-Static and EU-Out-Bytes-HTTPS-Dynamic by a cache duration above or below one hour, transfer to the origin as EU-DataTransfer-Out-OBytes, requests as EU-Requests-Tier1 for HTTP and EU-Requests-Tier2-HTTPS for HTTPS, writing requests as EU-Requests-HTTPS-Proxy. Origin Shield appears with the code of the shield's AWS region as EUC1-Requests-OriginShield, CloudFront Functions as Executions-CloudFrontFunctions, invalidations as Invalidations, Lambda@Edge as EU-Lambda-Edge-Request and EU-Lambda-Edge-GB-Second under the region code of the executing cache, real-time logs as RealTimeLog-KinesisDataStream, the dedicated certificate as SSL-Cert-Custom. The free allowance appears as Global-DataTransfer-Out-Bytes and Global-Requests-Tier1 at 0 and stretches across all world regions.

What the report delivers per distribution is the volume per world region and per request type; what it does not deliver is the cache hit ratio and with it the question whether the origin is relieved. The CloudWatch metrics Requests, BytesDownloaded and CacheHitRate per distribution and the standard logs per request show that. The transfer from the origin sits at the origin as EUC1-CloudFront-Out-Bytes at 0, so a distribution in front of a bucket makes the S3 line DataTransfer-Out-Bytes fall and the CloudFront line rise; the method for both lines is in data transfer pricing. The report's structure is described in the AWS Cost and Usage Report. In the FOCUS export, ServiceName carries Amazon CloudFront and x_ServiceCode AmazonCloudFront; transfer, requests and functions are ChargeCategory Usage, and the world region sits only in x_UsageType, not in RegionId (FOCUS columns).

Levers

Configuration: the cache duration is the first lever, not for the transfer, which accrues per delivered GB from the cache or not, but for the requests at the origin and its compute; long TTLs and cache keys without superfluous query parameters raise the hit ratio. Compression is the second, because CloudFront charges per delivered GB and Brotli or gzip cut the bytes for text, scripts and JSON several times over. The price class is the third for distributions whose viewers sit in Europe and North America: Price Class 100 keeps the expensive world regions off the bill. The general method is in data transfer optimisation.

Purchase option: there is neither a reservation nor a Savings Plan for CloudFront; from several hundred TB a month customers negotiate rates of their own as part of an enterprise agreement. The flat-rate plan is the second form: a fixed monthly price against the risk of the tiers, worthwhile when the sum of transfer, requests and WAF fees sits above the plan for good or spikes would break the budget.

Architecture: CloudFront in front of every bucket and every load balancer that serves to the internet, because transfer from the origin is free and the GB price sits below the services' (S3 pricing); CloudFront Functions instead of Lambda@Edge for header changes, redirects and simple logic, because they cost a fraction; Origin Shield only where the origin makes requests dear. The dimensions across all three providers are set side by side in CDN.

Where it goes wrong

• The origin serves directly. A bucket or a load balancer whose address clients know directly pays the service's internet transfer instead of CloudFront's. Lines with DataTransfer-Out-Bytes under AmazonS3 or AmazonEC2 beside a distribution show the detour around the distribution.
• The hit ratio is low. Query parameters in the cache key, short TTLs or Cache-Control: no-store from the origin turn every request into a miss. The transfer stays the same, but the origin carries every request; CacheHitRate in CloudWatch shows it.
• The world region is dearer than expected. Viewers in South America, India or Australia pay several times the European rate per GB, and SA- and AP- lines grow with them. Price Class 100 or 200 limits the locations.
• Lambda@Edge instead of CloudFront Functions. A header change in Lambda@Edge pays per request and GB-second at three times the Lambda rate. CloudFront Functions cost a fraction of that per million.
• Invalidations in the deployment. A deployment that invalidates a thousand paths one by one pays per path above the allowance. A wildcard path counts as one; versioned file names need no invalidation.
• The certificate costs USD 600. A custom certificate with a dedicated IP for clients without SNI costs more per month than most distributions. SNI certificates cost nothing.
• The flat-rate plan covers no other origin traffic. The plan covers the distribution, not the compute or storage behind it; the allowances apply per distribution and are checked against your own history in the console comparison.

Example

List prices in USD for Europe, read on 2026-10-21 from the AWS price list: data transfer to viewers costs USD 0.085 per GB for the first 10 TB a month, USD 0.080 up to 50 TB, USD 0.060 up to 150 TB, USD 0.040 up to 500 TB, USD 0.030 up to 1 PB, USD 0.025 up to 5 PB and USD 0.020 beyond, after 1 TB of free allowance; requests USD 0.0090 per 10,000 over HTTP and USD 0.0120 over HTTPS, after 10 million of free allowance; transfer to the origin USD 0.020 per GB; Origin Shield USD 0.009 per 10,000 requests in Frankfurt; CloudFront Functions USD 0.10 per million above 2 million; invalidations USD 0.005 per path above 1,000; a custom certificate with a dedicated IP USD 600 a month; the flat-rate plans USD 0, 15, 200 and 1,000 a month.

A distribution that delivers 10 TB a month to viewers in Europe and answers 50 million HTTPS requests pays USD 783.36 of transfer for the 9,216 GB above the allowance and USD 48.00 for the 40 million requests above the allowance, USD 831.36 in all. The same bucket without a distribution pays USD 912.60 for 10 TB of S3 transfer to the internet and USD 21.50 for 50 million GET requests, USD 934.10 in all, and carries every request itself. At 100 TB a month the CloudFront transfer costs 10,240 × 0.085 + 40,960 × 0.080 + 50,176 × 0.060 = USD 7,157.76 less the allowance, about USD 7,071, against about USD 7,978 for the same transfer from S3. The figures show that CloudFront in front of a bucket saves about a tenth even without cache hits, that the tiers bite from 50 TB, and that requests at an average of 200 KB per object make up a sixteenth of the transfer.

Sources

Read on 2026-10-21. Prices: Amazon CloudFront pricing, AWS Price List, offer AmazonCloudFront, offer AmazonS3 for eu-central-1. Billing data: interpreting your AWS bill and usage reports for CloudFront, FOCUS 1.0 with AWS columns. Service: CloudFront flat-rate pricing plans, flat-rate pricing plans: new features and expanded capabilities, Origin Shield.