How to Delete a CloudFront Distribution: Disable First, the ETag, "DistributionNotDisabled", the Pricing Plan That Blocks Deletion, and the Charges That Stay Behind

To delete an Amazon CloudFront distribution, you first disable it, wait a few minutes until the change has spread to every edge location, and only then delete it. The Delete button stays grayed out, and the API answers DistributionNotDisabled, until the first two steps are done. That much is well known. The newer trap is not: a distribution subscribed to one of CloudFront's flat-rate pricing plans cannot be deleted at all until you cancel the plan, and a paid plan's cancellation only takes effect at the end of the current billing cycle, so you may be waiting weeks, not minutes. Disabling it stops it serving traffic in the meantime. This page covers the console and CLI steps, every error (DistributionNotDisabled, PreconditionFailed, InvalidIfMatchVersion, ResourceInUse and the pricing-plan message), what to clean up afterwards (origin access control, Lambda@Edge, the S3 bucket policy, DNS records) and how to find which CloudFront charge is still on your bill.

Jake moved his shop website to a new host in September and expected the AWS bill to fall to almost nothing. It did not: CloudFront was still on it. When his developer friend Ethan opened the console, the old distribution was still there, still enabled, and the Delete button was grayed out. Disabling it worked; deleting it, fifteen minutes later, produced a message neither of them had seen before: "You can't delete this distribution while it's subscribed to a pricing plan." "So it is a subscription now," Jake said. "Like the gym," Ethan said. "You cancel, and they keep you until the end of the month." This page is everything they did to get rid of it properly.

New to CloudFront? A distribution is one CloudFront setup: a domain name, the origin it fetches from (often an S3 bucket or a load balancer) and its caching rules. You need permission to update and delete distributions; a deleted distribution cannot be recovered, so note its settings first if you might want them again.

Before you delete: three things to check

1. Is anything still using it? Disabling stops CloudFront answering for the distribution's alternate domain names (such as www.example.com) immediately after it spreads, even if another distribution has a matching wildcard. If a live site still points there, move the domain first; our CNAMEAlreadyExists guide shows how to move a domain between distributions without downtime.
2. Is it on a flat-rate pricing plan? The distribution's page in the console shows its plan. If it has one, read the pricing plan section first, because that changes the timeline.
3. Was it created by something else? Distributions made by CloudFormation, Terraform, the CDK or another AWS service should be removed through that tool, or the tool will try to recreate or update a distribution that no longer exists. See the infrastructure-as-code section.

Delete a CloudFront distribution in the console

1. Open the CloudFront console and choose Distributions.
2. Find your distribution. If its status is already Disabled, skip to step 5. If it shows Deploying under Last modified, wait for that to finish first.
3. Select it, choose Disable, and confirm. The Status column changes to Disabled at once.
4. Wait until a new timestamp appears under Last modified. That is the moment the change has reached every edge location; it usually takes a few minutes.
5. Select it again and choose Delete, then confirm.

If Delete is still grayed out after step 4, CloudFront is still spreading the change. Wait a few more minutes and refresh; the button becomes available as soon as the timestamp updates. A multi-tenant distribution (the SaaS kind) has one extra step: delete all its distribution tenants first, under its Tenants list, then disable and delete it the same way.

Delete a CloudFront distribution with the AWS CLI

The API protects distributions with an ETag, a version marker that changes on every update. Every change must quote the current ETag in --if-match, which is what trips most scripts. The whole sequence, with jq to edit the JSON:

ID=E2QWRUHAPOMQZL

# 1. Read the current configuration and its ETag
aws cloudfront get-distribution-config --id "$ID" > dist.json
ETAG=$(jq -r '.ETag' dist.json)

# 2. Turn Enabled off and send the whole configuration back
jq '.DistributionConfig | .Enabled = false' dist.json > disabled.json
aws cloudfront update-distribution --id "$ID" --if-match "$ETAG" \
  --distribution-config file://disabled.json

# 3. Wait until the change has reached every edge location
aws cloudfront wait distribution-deployed --id "$ID"

# 4. Delete, using the NEW ETag that the update produced
ETAG=$(aws cloudfront get-distribution --id "$ID" --query ETag --output text)
aws cloudfront delete-distribution --id "$ID" --if-match "$ETAG"

Two details matter. update-distribution needs the complete configuration, not just the changed field, which is why step 2 sends the whole DistributionConfig back. And the ETag from step 1 is dead after step 2: deleting with it fails with PreconditionFailed, so step 4 fetches a fresh one. On Windows, the same commands work in Git Bash or WSL; in PowerShell, use ConvertFrom-Json instead of jq, or simply use the console.

"You can't delete this distribution while it's subscribed to a pricing plan"

CloudFront now offers flat-rate pricing plans (Free, Pro, Business and Premium tiers) that bundle the CDN with AWS WAF, DDoS protection, Route 53 DNS, log ingestion and S3 storage credits for one monthly price with no overage charges. Each plan covers one distribution with up to one apex domain. Premium starts at $1,000 a month. If you, a teammate or a setup wizard put your distribution on a plan, deleting it is blocked:

You can't delete this distribution while it's subscribed to a pricing plan.

The way out, in order:

1. Cancel the plan: Distributions, choose the distribution, and follow the prompts to cancel its pricing plan.
2. Know when it ends. A Free plan is canceled immediately. A paid plan keeps its flat-rate price through the end of the current billing cycle, then the distribution switches to pay-as-you-go pricing at the start of the next cycle.
3. Disable the distribution now so it serves nothing in the meantime; with no traffic, pay-as-you-go has nothing to charge for requests or data transfer.
4. Delete it after the cycle ends, with the normal steps above.

If you canceled by mistake, or changed your mind about the tier, a pending cancellation can itself be canceled from the same distribution page before the cycle ends. Note that a plan change made near the end of a cycle still runs to that cycle's end; to avoid paying for another month at the plan price, cancel or downgrade before the new cycle begins.

Jake's distribution was on the Free plan, which a setup wizard had picked when he first created it, so the cancellation took effect at once and the delete went through the same afternoon. "Free plan, free exit," Ethan said. "The paid ones make you wait for the end of the month."

Every error when deleting a CloudFront distribution

Clean up after the distribution is gone

Deleting the distribution removes the CloudFront part only. Five things often stay behind:

Deleted it and still see CloudFront charges? Find the exact line

Usage is billed after it happens, so a charge for the days before you disabled the distribution can still appear on the next bill. Beyond that, open Cost Explorer, filter Service to CloudFront, and group by Usage type. The usage type names the meter: data transfer out to a region, HTTP or HTTPS requests, invalidations, real-time logs. Then check, in order:

1. Other distributions: aws cloudfront list-distributions --query 'DistributionList.Items[].[Id,DomainName,Enabled,Comment]' --output table. Old test distributions are the usual find.
2. Other accounts: in an AWS Organization, the charge may come from another member account; the bill's account breakdown shows which.
3. A pricing plan still running to the end of its cycle, if you canceled a paid plan.
4. Free tier ending. If the charge appeared when your account's free period ended rather than when traffic rose, our free tier charges guide explains the switch.

Jake's remaining line turned out to be data transfer from the last days of September, before the distribution was disabled. The October bill had no CloudFront line at all. "So that was the last of it," he said. "That was the last of it," Ethan said, "unless you start another one."

Deleting distributions made by Terraform, CloudFormation or the CDK

Remove the distribution from your code and apply, rather than deleting it by hand; the tool then handles the disable-wait-delete sequence itself, which is why deleting a CloudFront resource can take many minutes in a stack. If a stack deletion fails on the distribution, our CloudFormation DELETE_FAILED guide covers retaining or skipping a resource. If someone already deleted it by hand, Terraform needs terraform state rm for that resource, and a CloudFormation stack needs the resource retained on deletion, or both will keep trying to manage a distribution that no longer exists. A distribution on a paid pricing plan blocks these tools in the same way as the console, so cancel the plan first.

Can't delete the CloudFront distribution? Troubleshooting by symptom

The Delete button is grayed out

The distribution is still enabled, or the disable has not finished spreading. Disable it and wait until a new timestamp appears under Last modified.

Disabled an hour ago and still cannot delete

Check the distribution's page for a pricing plan; a subscribed distribution cannot be deleted until the plan is canceled and, for paid plans, the billing cycle ends.

PreconditionFailed from delete-distribution

You used the ETag from before the disable. Fetch the current one with aws cloudfront get-distribution --id ID --query ETag and retry.

update-distribution complains about missing fields

It needs the full DistributionConfig, not a partial one. Use get-distribution-config, change only Enabled, and send the whole object back.

The website went down when I disabled the distribution

The domain still pointed at it. Re-enable it to restore service, move the domain to the new setup first, then disable again.

Cannot delete the Lambda@Edge function afterwards

CloudFront is still removing the function's replicas from its edge locations. Wait a few hours and try again.

The distribution keeps coming back

An infrastructure-as-code tool or a pipeline recreates it. Remove it from the code or stack, not only from the console.

Deleting a CloudFront distribution: frequently asked questions

With the distribution gone, Ethan also deleted the old OAC, the WAF web ACL nobody remembered creating, and two Route 53 records pointing at a cloudfront.net name that no longer existed. Jake's November bill was the smallest it had been all year. He printed it. "Proof," he said, "that I finished something in the cloud."

Revision note. Written October 22, 2026, from the CloudFront Developer Guide and API reference of that date, including the flat-rate pricing plan rules. "Measure twice, cut once," the proverb says; a deleted distribution cannot be undone, so save its configuration first.