AWS costs: CloudFront pricing - and the free tier that got generous

Short answer: CloudFront still gives every AWS account 1 TB of data transfer and 10 million requests free every month, forever, with no sign-up required — that part hasn't shrunk. What's new is a separate $0-to-$1,000/month set of flat-rate plans that bundle a firewall and DDoS protection on top of CloudFront, and the confusing part is that the new $0/month plan only includes 100 GB of data a month — a tenth of the free tier you already had.

Jake found out about the free tier the hard way — by not needing it. His shop's site sat quietly on S3 and CloudFront for two years, comfortably inside the free 1 TB, and he never looked at the CloudFront line item because there wasn't one. Then a local news segment about his trade-in weekend got shared a few hundred times on a Saturday, his product photos got hit harder than usual, and he spent Sunday night convinced Monday's invoice was going to eat the weekend's profit.

It didn't. He was still under a terabyte. But the scare was real, and it's the same scare a lot of small site owners have, because CloudFront's pricing page now shows two different things that both say "free" — and they are not the same free.

What CloudFront actually charges you for

CloudFront is Amazon's content delivery network (CDN) — a global set of edge locations that cache your website's files close to the people requesting them, so a visitor in Chennai isn't waiting on a server in Virginia for every image. AWS bills for it along four basic lines: data transferred out to your visitors, the number of requests those visitors make, any edge compute you run (CloudFront Functions or Lambda@Edge), and a handful of feature add-ons like invalidations, real-time logs, and dedicated SSL. Everything else — caching, the global network, HTTP/2 and HTTP/3 support — comes along for free with the base service.

There are, as of 2026, two entirely different ways to pay for all of that: the pay-as-you-go model CloudFront has always used, and a newer set of flat-rate plans that roll CloudFront together with AWS WAF (a web application firewall that inspects and blocks malicious requests before they reach your server), DDoS protection, Amazon Route 53 DNS, and a TLS certificate for one monthly price. You pick a model per distribution, not per account, so a busy production site and a hobby project in the same AWS account can be on completely different plans.

The Always Free tier: what's actually included

Every AWS account, on the pay-as-you-go model, gets what AWS calls the Always Free tier. It applies automatically, it doesn't expire after twelve months the way some other AWS free-tier offers do, and it doesn't require you to opt in anywhere. It includes:

• 1 TB of data transfer out to the internet, per month
• 10,000,000 HTTP or HTTPS requests, per month
• 2,000,000 CloudFront Function invocations, per month
• 2,000,000 CloudFront KeyValueStore reads, per month — KeyValueStore is a small, fast data store a CloudFront Function can read from while it's running at the edge, for things like feature flags or redirect maps
• 10 Distribution Tenants at no charge — a Distribution Tenant is a lightweight, customer-specific configuration layered on top of one main distribution, mostly used by SaaS platforms serving many customers off one setup
• A free SSL/TLS certificate through AWS Certificate Manager

That covers a genuinely large share of small and mid-size sites without any billing surprise at all. A typical brochure site, blog, or small shop's product catalog can run for months without crossing 1 TB — Jake's near-miss weekend still landed comfortably under it.

Free tier vs. Free plan: the one everyone confuses

Here's the counterintuitive part, and it's the reason this section exists. AWS now also sells a flat-rate Free plan — a $0-per-month tier of the newer flat-rate pricing system. It is a completely different product from the Always Free tier above, and its usage allowance is smaller, not larger:

Ethan's take is blunt about it: "The flat-rate Free plan isn't really a 'more generous free tier' — it's a security bundle wearing a free-tier badge. If your only goal is bandwidth, the plain Always Free tier is bigger. If your goal is a firewall and DDoS protection without touching AWS WAF pricing separately, the flat-rate Free plan is genuinely useful — just don't confuse the two when you're estimating a bill."

The flat-rate plans: Free, Pro, Business, Premium

Each flat-rate plan covers exactly one CloudFront distribution with up to one apex (root) domain, for one flat monthly price, with no overage charges regardless of traffic spikes or attacks. Every plan bundles the CloudFront CDN, AWS WAF, always-on DDoS protection, Amazon Route 53 DNS, CloudWatch Logs ingestion, a free TLS certificate, CloudFront Functions, and monthly Amazon S3 storage credits you can use even if S3 isn't your origin.

Premium's usage allowance is also the one plan you can scale up without leaving the flat-rate world: you can step it from the default 50 TB / 500 million requests at $1,000 a month up to 600 TB / 6 billion requests at $10,000 a month, in fixed increments, with the price adjusting immediately and prorated.

Pay-as-you-go: data transfer pricing by region

On pay-as-you-go, data transfer out to the internet is billed per GB, in tiers that get cheaper the more you use, and the rate depends on which region delivered the content to your visitor. The first 1 TB is free everywhere — that's the Always Free tier applying automatically — after which the price splits by region.

The cheapest and most expensive regions

The United States, Mexico, Canada, Europe, Israel, and Türkiye are CloudFront's cheapest delivery regions at $0.085/GB for the next 9 TB after the free terabyte, dropping to $0.080, $0.060, $0.040, $0.030, $0.025, and finally $0.020/GB as volume climbs into the petabyte range. South Africa, Kenya, Nigeria, Egypt, the Middle East, and South America start at $0.110/GB. Japan and Australia/New Zealand start around $0.114/GB. Hong Kong, Indonesia, the Philippines, Singapore, South Korea, Taiwan, Thailand, Malaysia, and Vietnam start at $0.120/GB — the single highest starting rate on the list. India sits close to the cheap end at $0.109/GB.

Data transferred from CloudFront back to your origin — the POST and PUT traffic, plus any WebSocket or gRPC traffic flowing client-to-server — is billed separately and is cheapest in the US, Mexico, Canada, and Europe at $0.020/GB, and most expensive in India at $0.160/GB and South America at $0.125/GB.

Requests, CloudFront Functions, and Lambda@Edge

Requests are billed per 10,000, after the first 10 million HTTP(S) requests each month, which are free under the Always Free tier. HTTPS requests cost more than HTTP because of the TLS handshake overhead — the encryption setup a browser and CloudFront perform before any content moves — and in the US, Mexico, and Canada that's $0.0075 per 10,000 HTTP requests versus $0.0100 per 10,000 HTTPS requests. Other regions run $0.0090–$0.0160 for HTTP and $0.0120–$0.0220 for HTTPS, with South America the most expensive for both.

If you're running code at the edge, there are two very different price tags depending on which tool you reach for:

1. CloudFront Functions — a lightweight JavaScript runtime for things like URL rewrites, header manipulation, and cache-key normalization. Invocations cost $0.10 per million, and the first 2 million invocations every month are free under the Always Free tier — and included at no extra charge on every flat-rate plan.
2. Lambda@Edge — a full Node.js or Python environment for heavier logic like origin selection or complex request transformation. It costs $0.60 per million requests plus a duration charge of $0.00005001 per GB-second (about $0.00000625125 per 128 MB-second, metered to 1ms), and it has no free tier at all, on any pricing model — including flat-rate plans, where it's billed pay-as-you-go on top of whatever you're already paying.

Ethan doesn't hedge on this one: "If CloudFront Functions can do the job, use it — it's a rounding error on your bill. Reach for Lambda@Edge only when you genuinely need Node or Python and can't get there with JavaScript running in the lighter sandbox. People pull in Lambda@Edge out of habit and then wonder why a traffic spike moved their bill."

The fees nobody reads until they're on the bill

Beyond bandwidth and requests, a handful of feature charges catch people off guard because they're easy to enable in a console checkbox and just as easy to forget about six months later:

• Invalidations — clearing an old, cached file so CloudFront fetches a fresh copy. The first 1,000 paths or cache-tags you request to be purged each month are free; after that it's $0.005 per path.
• Real-time logs — $0.01 per 1,000,000 log lines published to your log destination. Standard access logs, by contrast, carry no extra CloudFront charge beyond whatever storage you send them to.
• Field-level encryption — $0.02 per 10,000 requests encrypted, on top of the standard HTTPS request fee. Used for encrypting specific sensitive fields, like a credit card number, separately from the rest of a request.
• Dedicated IP custom SSL — $600 per month per certificate, prorated by the hour, for the legacy dedicated-IP form of custom SSL. (This is unsupported on flat-rate plans entirely.)
• Anycast Static IPs — $3,000 per month per IP list, for customers who need a fixed, dedicated set of static IPs for their distribution rather than the ones CloudFront assigns automatically.
• CloudWatch Logs ingestion — you get 750 bytes of log delivery per request free; overage runs $0.50/GB for the first 10 TB a month, dropping to $0.10/GB and eventually $0.05/GB at higher volumes, with Kinesis Data Firehose and Infrequent Access tiers priced lower.
• Distribution Tenants (CloudFront SaaS Manager) — the first 10 per month are free, 11–200 cost a flat $20 subscription fee, and beyond 200 it's $0.10 per tenant.

Origin Shield's own request fee

If you turn on Origin Shield — an extra caching layer that sits between CloudFront's edge locations and your origin, consolidating requests from all those edge locations so your origin sees far fewer of them during a traffic spike — it carries its own per-request charge, separate from the standard request pricing above. The fee is based on whichever AWS Region you designate as your Origin Shield Region, not on the edge location that actually served the visitor: roughly $0.0075 per 10,000 requests in the US, $0.0090 in Europe, Japan, Australia, Singapore, South Korea, and India, and $0.0160 in South America.

It's an additional layer's fee, not a duplicate of the standard request charge — you're paying once for the edge request and again, at this lower rate, for the requests that reach Origin Shield from your regional caches. For a busy dynamic site, it's usually worth it anyway: fewer requests reaching your actual origin server or database tends to save more elsewhere than Origin Shield itself costs, which is exactly where it earns its keep.

One small piece of good news buried in the fine print: CloudFront doesn't add any protocol surcharge for WebSocket or gRPC traffic. Both are billed at the same standard data transfer and request rates as any other connection — there's no separate "real-time" line item to budget for just because a connection stays open longer than a normal HTTP request.

On a flat-rate plan, real-time logs, field-level encryption, dedicated IP custom SSL, and Anycast IP lists aren't available at all — they're on the unsupported-features list, so if your distribution needs any of them, pay-as-you-go is your only option for that distribution.

Price Classes: the setting most people never touch

By default, CloudFront delivers your content from its entire global network of edge locations, which means you're paying whatever rate applies wherever a given visitor happens to be served from — including the pricier regions above. A Price Class setting lets you exclude the most expensive edge locations from a distribution on purpose, in exchange for slightly higher latency for visitors in the excluded regions.

If a visitor outside your chosen price class still ends up served from an edge location outside it — which can happen for network reasons — CloudFront only ever charges you the rate for the least expensive location inside your selected class, never the actual, pricier one. That's a one-way protection: it can save you money, it never costs you extra.

Savings Bundle and committed discounts

For pay-as-you-go customers with steady, predictable volume, the CloudFront Security Savings Bundle offers up to 30% off your CloudFront bill in exchange for a one-year commitment to a monthly spend level you choose yourself. It's a self-service plan — no sales call required — and the discount applies broadly, covering data transfer, CloudFront Functions, and Lambda@Edge usage, not just bandwidth. It also throws in AWS WAF usage free up to 10% of your committed spend, which is worth factoring in if you were already planning to add a WAF on top of pay-as-you-go pricing.

Separately, if your workload runs at least 10 TB of data transfer a month and you're willing to commit for 12 months or longer, custom discounted pricing is available by contacting AWS sales directly, with the discount scaling with the size of the commitment. That path is a negotiation, not a self-service toggle — expect it to take longer to set up than a Savings Bundle, in exchange for a deeper discount at real scale.

Which pricing model should you actually pick?

Ethan's opinion here is unambiguous: "For most small-to-medium sites, Pro at $15 a month is the easiest decision on this whole page. You get a real WAF, DDoS protection, and DNS for less than a lot of people pay for a single third-party security add-on, and you never have to think about a per-GB bill again. Pay-as-you-go earns its keep at the extremes — genuinely tiny, or genuinely huge — not in the middle."

Forecasting your bill before you switch or commit

Every table in this post is a rate card, not your bill. We can tell you exactly what a gigabyte costs in Singapore versus Ohio; we can't tell you how many gigabytes you'll actually move next month, because that number lives in your own CloudFront usage data, not in any pricing page.

Two places actually answer that for you. First, the CloudFront console's usage report shows your real data transfer, request counts, and function invocations for the current billing period — the same numbers that decide whether you're inside the Always Free tier, approaching a flat-rate plan's allowance, or already past it. Second, the AWS Pricing Calculator lets you build a CloudFront estimate by plugging in your expected volume and region mix before you commit to a Savings Bundle, a custom contract, or even just a plan tier — worth five minutes before signing anything with a one-year term attached to it.

What happens when you exceed a flat-rate plan's allowance

The phrase "no overage charges" on a flat-rate plan doesn't mean unlimited usage — it means AWS handles overage with performance, not a bill. The allowances are described as a baseline, not a hard wall, and here's how AWS applies that in practice:

1. Your first traffic spike up to 3x your monthly allowance in a given month doesn't affect your service at all — a one-time accommodation for a viral moment or a successful launch.
2. Sustained usage above your allowance is judged over two to three months or more, not the instant you cross the line, so ordinary month-to-month growth is absorbed without penalty.
3. You get automatic email notifications at 50%, 80%, and 100% of your allowance so you can see it coming.
4. If usage stays substantially and consistently above your tier without an upgrade, AWS may adjust how your traffic is delivered — for example, serving from fewer or more distant edge locations — proportional to how far over you are.
5. Upgrading your plan restores full performance immediately, with the price and allowance prorated for the rest of the billing cycle.

Blocked DDoS attacks and requests blocked by your WAF rules never count against your allowance in the first place — only traffic that gets past your security rules counts, which is a genuinely useful protection against being penalized for surviving an attack.

Two real-shaped examples

Take Jake's shop site again, on pay-as-you-go in the US region, on an ordinary month: 300 GB of data transfer out, 500,000 HTTPS requests, and a lightweight CloudFront Function doing header rewrites on every request. All three numbers sit comfortably inside the Always Free tier's 1 TB, 10 million requests, and 2 million function invocations — the bill is $0.00. That's true for a large share of small business sites, which is exactly why so many owners never open the CloudFront line item on their invoice.

Now stretch it: a growing regional retailer serving 15 TB of data a month in the US, at 40 million HTTPS requests, running a CloudFront Function on every request. Data transfer costs roughly $0.085/GB for the 9 TB after the free terabyte (about $765), then $0.080/GB for the next 5 TB (about $400) — call it $1,165 for data transfer. Requests beyond the free 10 million run $0.01 per 10,000, so 30 million extra requests cost about $30. The function invocations, past the free 2 million, run $0.10 per million — roughly $3.80 for 38 million extra calls. All told, that's a little over $1,200 a month on pay-as-you-go — a workload that would fit inside a $1,000/month Premium flat-rate plan's default 50 TB / 500 million allowance with room to spare, which is the kind of comparison worth actually running before assuming pay-as-you-go is cheaper just because it's the default.

One more shape worth seeing: a video-heavy site running Origin Shield in the US to smooth out load on its origin during live events, generating 5 million Origin Shield requests a month. At $0.0075 per 10,000 requests, that's about $3.75 — a small number sitting on top of whatever the underlying data transfer and standard request charges already come to. It's easy to add without noticing, and exactly the kind of line item worth checking is genuinely paying for itself in reduced origin load rather than running out of habit.

Switching between pay-as-you-go and a flat-rate plan

You can subscribe an existing distribution to a flat-rate plan, or move it back to pay-as-you-go, from the CloudFront console. A few mechanical details matter more than they look like they should:

• Upgrading a plan tier — or increasing a Premium usage level — takes effect immediately, with price and allowance prorated for the rest of the cycle.
• Downgrading — including dropping a Premium usage level — takes effect at the start of the next billing cycle, so you'll be charged at your current tier through the end of the month you downgrade in.
• Canceling a paid plan keeps your flat rate through the end of the current cycle, then switches the distribution to pay-as-you-go at the next cycle. Free plans cancel immediately.
• You can't delete a distribution while it's subscribed to any pricing plan — cancel the plan first, then delete.
• An AWS account can hold at most 3 free flat-rate plans and 100 pricing plan subscriptions in total, and each plan covers only one apex-level domain.
• Your historical usage can affect what tiers you're even eligible to subscribe to or downgrade into — if your last few months already exceed a tier's allowance, AWS may require a higher tier.

One account-level catch worth knowing before you try: accounts that are currently inside AWS's broader promotional Free Tier period are not eligible to subscribe to flat-rate pricing plans at all. That's a different "free tier" again — the account-wide new-customer promotion, not the CloudFront Always Free usage tier — but it's exactly the kind of overlapping terminology that trips people up on this topic, so it's worth checking your account's eligibility in the console rather than assuming.

Common mistakes that blow up a CloudFront bill

Most CloudFront bill shocks trace back to a small number of repeatable causes, not to the pricing model itself:

• Leaving Price Class on "All" for an audience that's entirely regional — quietly paying the most expensive per-GB rates for edge locations nobody actually uses.
• Reaching for Lambda@Edge for logic CloudFront Functions could handle just as well, and paying per-request and per-GB-second for it with no free tier cushion.
• Automating cache invalidation on every deploy without batching paths, quietly burning through the 1,000 free invalidation paths and into $0.005-per-path territory.
• Turning on real-time logs for debugging and forgetting to turn them off — they bill per log line, indefinitely, until disabled.
• Assuming a flat-rate plan's allowance is unlimited because there's no overage charge — then being surprised when sustained, heavy overuse gets throttled instead of billed.
• Not attaching Route 53 zones to a flat-rate plan when eligible, leaving DNS on separate pay-as-you-go billing when the plan could have absorbed it.
• Turning on Origin Shield everywhere without checking its own per-request fee — it usually pays for itself in reduced origin load, but it's an added line item, not a free upgrade.

Frequently asked questions

Is CloudFront free to use?

Yes, up to a point, and without signing up for anything extra. Every AWS account gets the Always Free tier automatically: 1 TB of data transfer out and 10 million HTTP/HTTPS requests every month, with no expiration date. Past that, pay-as-you-go charges apply, or you can subscribe a distribution to the flat-rate Free plan instead, which has a smaller 100 GB / 1 million request allowance but bundles a WAF and DDoS protection.

What's the difference between the Always Free tier and the $0/month Free plan?

The Always Free tier is a pay-as-you-go allowance that applies automatically to every account: 1 TB and 10 million requests. The $0/month Free plan is a separate, opt-in flat-rate product with a smaller 100 GB and 1 million request allowance, but it adds AWS WAF, DDoS protection, Route 53 DNS, and a TLS certificate bundled in at no cost. They're not stacked on top of each other — a distribution is on one pricing model or the other.

How much does CloudFront charge per GB?

It depends on region and volume. In the US, Mexico, Canada, Europe, Israel, and Türkiye, the first 1 TB is free, the next 9 TB runs $0.085/GB, and the rate keeps dropping as volume climbs, down to $0.020/GB past 5 PB. Other regions start higher, up to $0.120/GB in parts of Asia for the first paid tier.

Does CloudFront charge for data coming from S3?

No. Data transferred from an AWS origin — S3, EC2, an Application Load Balancer, or API Gateway, including origins in a private VPC subnet — into CloudFront is free, on both pay-as-you-go and every flat-rate plan. You only pay for the data CloudFront serves back out to your visitors, and for traffic flowing from CloudFront back to your origin, like POST and PUT requests.

What counts as a "request" for billing?

Every HTTP or HTTPS request CloudFront receives and responds to, whether it's served from cache or forwarded to your origin. HTTP and HTTPS are priced separately, with HTTPS costing more per 10,000 requests because of the added TLS overhead — but the first 10 million combined requests each month are free under the Always Free tier.

What is a CloudFront Price Class and should I change mine?

Price Class controls which of CloudFront's edge locations are allowed to serve your content, and it's set per distribution. The default, Price Class All, uses every edge location worldwide, including the priciest regions. If your audience is concentrated in North America and Europe, switching to Price Class 100 or 200 can lower your per-GB rate without any downside beyond slightly higher latency for the excluded regions.

Do CloudFront Functions cost anything?

Yes, but very little: $0.10 per 1 million invocations. The first 2 million invocations each month are free under the Always Free tier, and they're included at no extra charge on every flat-rate plan too, regardless of tier.

How much is Lambda@Edge and when do I need it instead of CloudFront Functions?

Lambda@Edge costs $0.60 per million requests plus a duration charge based on memory and execution time, and it has no free tier on any pricing model, flat-rate included. Reach for it only when your logic needs a full Node.js or Python runtime, network access, or capabilities CloudFront Functions' lightweight JavaScript sandbox can't provide — origin selection based on complex conditions is a common example.

What is the CloudFront Savings Bundle and is it worth it?

It's a self-service discount of up to 30% off your CloudFront bill in exchange for committing to a monthly spend level for one year. It applies broadly — data transfer, CloudFront Functions, and Lambda@Edge usage all count — and it includes free WAF usage up to 10% of your commitment. It's worth it once you have several months of stable, predictable traffic to commit against; it's a poor fit for a site whose traffic could swing wildly month to month.

How does the flat-rate plan handle a traffic spike?

Gently, the first time. Your first spike up to 3x your monthly allowance in a given month doesn't affect your service or incur any charge — it's designed specifically to absorb a viral moment or a successful launch without penalizing you for it. Only sustained excess usage evaluated over two to three months or more can trigger a delivery adjustment.

What happens if I go over my flat-rate plan's allowance every month?

You won't be billed extra — flat-rate plans genuinely have no overage charges. But if your usage stays substantially and consistently above your tier's allowance without an upgrade, AWS may adjust how your traffic is delivered, such as serving from fewer or more distant edge locations, proportional to how far over you are. Upgrading restores full performance immediately.

Can I switch from pay-as-you-go to a flat-rate plan without downtime?

Yes, it's done from the CloudFront console on an existing distribution, and it doesn't require recreating anything. The one prerequisite is that your distribution's configuration has to be compatible first — any unsupported feature, like real-time logs or dedicated IP custom SSL, has to be disabled before the switch will go through.

Does the flat-rate plan cover multiple distributions?

No — each flat-rate plan subscription covers exactly one CloudFront distribution, with up to one apex-level domain. If you run several distributions, each one is subscribed to its own plan (or to pay-as-you-go) independently, up to an account-wide cap of 100 pricing plan subscriptions and 3 free plans.

Are invalidation requests free?

The first 1,000 invalidation paths or cache-tags you submit each month are free. After that, it's $0.005 per path requested for invalidation — a cost that adds up quickly if you're invalidating on every single deploy without batching your paths.

Why is CloudFront more expensive in some countries?

Regional pricing reflects AWS's own cost of running edge infrastructure and network capacity in each part of the world. Parts of Southeast and East Asia carry the highest starting per-GB rate at $0.120, while the US, Canada, and much of Europe sit at the low end around $0.085. It's the same underlying network and the same feature set everywhere — only the delivery cost differs by region.

Do blocked DDoS or WAF requests count against my usage or allowance?

No, on either pricing model. Blocked DDoS attacks and requests blocked by your WAF rules never count toward your data transfer or request totals — only traffic that passes your security rules counts. That protects you from being effectively penalized, in cost or in allowance, for successfully surviving an attack.

Also Read:

• AWS costs: RDS vs Aurora pricing - a small app, both ways
• AWS costs: DynamoDB on-demand vs provisioned - the crossover math
• AWS costs: ECS on EC2 vs Fargate - the real hourly difference
• AWS costs: EKS control plane - $73/month before one pod runs
• CloudFront Not Updating? Cache Invalidation Done Right

• CloudFront 502 and 504 Errors: Origin Problems Explained and Fixed
• CloudFront 403 "The Request Could Not Be Satisfied": Every Cause, Fixed

Revision note. Written September 2026, covering both CloudFront's pay-as-you-go pricing and its flat-rate Free/Pro/Business/Premium plans as published on AWS's own pricing pages. This will need a refresh if AWS reprices a region, adjusts a plan's usage allowance, or adds a new tier — pricing pages like this one move faster than most. Jake's Saturday-night scare turned out to cost him nothing; if a real bill, not a hypothetical one, is what brought you here, take a breath — nearly every case in this post traces back to one setting or one habit, not a broken budget.HAppy learning! See you on next post