CloudFront Pricing Guide: Pay-As-You-Go vs Flat-Rate Plans (2026)

Pay-as-you-go is CloudFront's original and still-default billing model: you pay separately for data transfer out, requests, and any add-on features you use, with no cap on usage or spend. It rewards low or spiky traffic (the first 1 TB and 10 million requests are free every month, permanently) but scales linearly — there is no discount for committing to volume beyond the built-in regional tiering.

The flat-rate plans are a newer, separate option: a fixed monthly price buys a fixed data transfer and request allowance, bundled with AWS WAF rules, Route 53 DNS, and DDoS protection, with no overage billing — if you exceed the allowance, AWS does not charge more that month (AWS CloudFront pricing, 2026). This trades usage-based precision for budget predictability and bundles security services that would otherwise be billed separately (WAF, Shield-style DDoS protection, DNS). Pay-as-you-go remains fully available as an alternative — choosing a flat plan is opt-in, not a forced migration.

Data transfer out to the internet is billed per GB, tiered by cumulative monthly volume and split into eight regional rate groups based on which edge location serves the request (AWS CloudFront pay-as-you-go pricing, 2026):

The free first-terabyte tier resets every calendar month per AWS account, not per distribution — it does not stack if you run multiple distributions. The regional split matters most for global sites: the same 10 TB of monthly transfer costs roughly $765 served entirely from the US/Europe tier versus roughly $1,080 if the same volume instead billed at Asia Pacific rates, purely from which edge locations serve the traffic.

Every HTTP or HTTPS request CloudFront serves is billed per 10,000 requests, with HTTPS costing more than HTTP because of the TLS handshake overhead, and rates varying by region (AWS CloudFront pay-as-you-go pricing, 2026):

At scale, requests rarely dominate the bill the way data transfer does — 100 million monthly HTTPS requests served from US edges costs roughly $100, versus $340 for just 4 TB of data transfer in the same region. Request cost becomes the bigger line item mainly for API-style traffic (small responses, high request volume) rather than content-heavy sites (large assets, lower request-to-byte ratio).

A CloudFront distribution's price class controls which of the eight regional edge groups are allowed to serve its content — restricting it excludes the pricier regions from ever serving traffic, at the cost of higher latency for users physically closer to an excluded region:

Choosing Price Class 100 for a distribution whose audience is entirely North American or European costs nothing in reach — those users were already served from those edge locations under “All.” The savings show up only if some of your traffic would otherwise route through a pricier region (a small APAC user base, for example); for a genuinely global audience, restricting the price class trades real latency in the excluded regions for a transfer-rate saving that may not be worth it. Set the price class deliberately based on where your users actually are, not as a blanket cost-cutting default.

Alongside pay-as-you-go, AWS now offers flat monthly plans that bundle CloudFront with WAF, Route 53 DNS, DDoS protection, and S3 storage credits into one fixed price with no overage billing (AWS CloudFront pricing, 2026):

The allowance jump from Free to Pro is the sharpest in the lineup — 100 GB to 50 TB of data transfer for $15/month — while Business and Premium hold the same 50 TB transfer allowance and instead scale the request allowance, storage credit, WAF rule count, and feature set (uptime SLA, private VPC origins, bot management, origin failover). Practically, Pro and Business are the two tiers worth comparing against pay-as-you-go for most small-to-mid traffic sites; Premium and Custom mainly make sense once WAF rule count, bot management sophistication, or origin failover become the binding constraint rather than raw transfer volume.

Low traffic (200 GB transfer, 2M requests/month): Under pay-as-you-go, this sits entirely inside the always-free tier (1 TB transfer + 10M requests free every month) — the bill is $0. The flat “Free” plan's 100 GB allowance is actually smaller than pay-as-you-go's free tier, so this traffic level would technically exceed Free-plan data transfer while paying nothing under pay-as-you-go. The flat Free plan only wins here if you specifically want its bundled WAF/DDoS/DNS at no cost — for pure CDN economics at this volume, pay-as-you-go is free and Pro ($15/mo) would be pure overpay.

Mid traffic (5 TB transfer, 50M HTTPS requests/month, US/Europe): Pay-as-you-go: 1 TB free + 4 TB at $0.085/GB (~$340) for transfer, plus 40M billable requests (after the 10M free) at $0.0100/10,000 (~$40) — roughly $380/month, before any WAF, DNS, or DDoS protection costs, which are billed separately under pay-as-you-go. The Business flat plan covers this traffic entirely within its 50 TB / 125M-request allowance for a flat $200/month, bundling 50 WAF rules, Route 53 DNS, DDoS protection, an uptime SLA, and 1 TB of S3 storage credit — cheaper on CDN cost alone, and meaningfully cheaper once the bundled services are priced in separately.

Spiky/unpredictable traffic: Pay-as-you-go has no cap, so a viral spike simply bills more — annoying but not capacity-limited. A flat plan with no overage charges caps your bill, but check what happens at the cap: verify current throttling/degradation behavior above the allowance before relying on a flat plan as a hard budget ceiling for traffic you can't forecast.

A handful of CloudFront features are billed separately from base transfer and requests under pay-as-you-go, and worth budgeting for explicitly:

CloudFront Functions vs Lambda@Edge is the costliest choice to get wrong. Functions run lightweight JavaScript at every edge location for $0.10 per million invocations and sub-millisecond execution, suited to header manipulation, redirects, or simple auth checks. Lambda@Edge runs full Node.js/Python functions with more compute and integration options, but at $0.60 per million requests plus duration charges — six times the per-request base cost before duration is even added. Using Lambda@Edge for logic that CloudFront Functions could handle is a common, easily avoidable edge-compute overspend.

Separately from the flat “Free” plan, CloudFront has an always-free tier with no expiration — not a 12-month new-account promotion — covering the first 1 TB of data transfer out, 10,000,000 HTTP/HTTPS requests, 2,000,000 CloudFront Function invocations, and 2,000,000 KeyValueStore reads every calendar month, plus free SSL certificates and 10 distribution tenants (AWS CloudFront pay-as-you-go pricing, 2026). This applies automatically under pay-as-you-go billing regardless of account age, and is the reason the low-traffic worked example above costs $0.

• Leaving Price Class set to “All” for a regional audience. A site serving only North American and European users pays nothing in reach by restricting to Price Class 100, but keeps paying the higher regional rate tiers if traffic ever does route through excluded regions.
• Reaching for Lambda@Edge by default. Header rewrites, simple redirects, and basic auth checks run fine on CloudFront Functions at a fraction of the per-request cost — reserve Lambda@Edge for logic that genuinely needs its larger runtime.
• Automating full-distribution invalidations on every deploy. A CI pipeline that invalidates /* on every push stays within the 1,000 free paths/month at low deploy frequency, but versioned asset filenames (cache-busting via hashed filenames) avoid needing invalidation at all for static assets.
• Comparing only the sticker price between pay-as-you-go and flat plans. The worked mid-traffic example above shows a flat plan can be cheaper on CDN cost alone and bundle WAF/DNS/DDoS that would otherwise be billed separately — run the comparison with those extras priced in, not just base transfer and requests.
• Not budgeting Origin Shield and real-time logs as separate line items. Both are opt-in and easy to forget when estimating a distribution's all-in cost, especially at high request volume where the per-10,000-request and per-million-log-line rates add up.