AWS CloudFront

What AWS CloudFront actually is

CloudFront is Amazon's content delivery network, running since November 2008 and now operating from 750+ edge points of presence plus 15 regional edge caches on every populated continent. It caches and accelerates HTTP(S) content close to the viewer, terminates TLS at the edge, and fronts whatever origin you point it at — S3, EC2, an Application Load Balancer, or an on-premises server via VPC origins. Origin fetches from AWS origins are free; you pay to get bytes to the internet.

The product's distinctive capability is programmable edge logic. CloudFront Functions runs lightweight JavaScript at edge locations at $0.10 per 1 million invocations; Lambda@Edge runs full Node.js and Python functions in regional edge caches at $0.60 per 1 million requests plus $0.00005001 per GB-second of duration. Between them you can rewrite URLs, normalize headers, validate tokens, or run A/B routing before a request ever reaches your origin. CloudFront KeyValueStore gives those functions a small low-latency config store, and Origin Shield adds a caching layer in front of your origin for multi-region setups.

Security is layered in: AWS WAF attaches directly, Shield Standard DDoS protection covers every AWS customer at no additional charge, TLS certificates are free via ACM, and access controls (OAI/OAC, signed URLs and cookies, field-level encryption) are all native. Price Class settings (100/200/All) let you trade coverage for cost by restricting which edge regions serve traffic — Price Class 100 serves only North America and Europe, which is a legitimate cost lever for sites whose audience is there, and a trap for anyone whose analytics say otherwise. We check viewer geography against price class whenever a CloudFront bill surprises someone.

Two capabilities deserve mention because they age well. Signed URLs and cookies let you gate premium content at the edge without touching the origin, and field-level encryption keeps sensitive fields encrypted end-to-end past the edge and the load balancer. For teams delivering licensed media or handling personal data in transit, these are the difference between a CDN and a delivery platform.

Pricing: what you really pay

CloudFront now sells two ways, and the newer one leads the pricing page.

Pay-as-you-go is the classic metered model. Data transfer out to the internet: the first 1 TB per month is free in every region; then tiered per-GB rates — in the United States, Mexico and Canada, next 9 TB at $0.085/GB, next 40 TB at $0.080, next 100 TB at $0.060, next 350 TB at $0.040, next 524 TB at $0.030. Europe, Israel and Türkiye share the same rates; other regions run higher (next 9 TB at $0.110 in the Middle East/Africa bucket, $0.114 in South America and Japan, $0.120 across much of Asia Pacific, $0.109 in India). Requests are billed per 10,000 after the first 10 million per month, which are free: $0.0075 per 10,000 HTTP and $0.0100 per 10,000 HTTPS in the US/Mexico/Canada region, $0.0090 and $0.0120 in Europe.

The free tier is unusually durable. AWS lists it as "Always Free Tier": 1 TB of data transfer out per month, 10,000,000 HTTP or HTTPS requests, 2,000,000 CloudFront Function invocations, 2,000,000 KeyValueStore reads, 10 distribution tenants, and free SSL certificates, with no feature limitations. For a small site, CloudFront genuinely costs nothing.

Then there are the flat-rate plans, priced per distribution with no overage charges: Free at $0/month (1M requests, 100 GB transfer, 5 GB S3 storage credit, 5 WAF rules), Pro at $15/month (10M requests, 50 TB transfer, 50 GB S3, 25 WAF rules), Business at $200/month (125M requests, 50 TB transfer, 1 TB S3, 50 WAF rules, bot management, advanced DDoS, uptime SLA), and Premium at $1,000/month (500M requests — configurable to 6B — 50 TB transfer — configurable to 600 TB — 5 TB S3, origin failover and load reduction). These bundle WAF, Route 53 DNS, CloudWatch Logs ingestion, TLS and edge compute into one number. Our reading: if you already buy WAF and Route 53 separately, the Business plan at $200/month can be arithmetic; if you just serve static assets, pay-as-you-go plus the always-free allowance is cheaper.

Performance & infrastructure

CloudFront's footprint is the argument for using it: 750+ PoPs and 15 regional edge caches per AWS's own infrastructure page. We have not benchmarked CloudFront against Cloudflare or Fastly in our /benchmarks runs, so no throughput claims from us — cache hit ratio, TLS session reuse and origin latency decide most of the outcome in practice, and those are configuration, not vendor.

The tiered cache structure is worth understanding: edge locations cache content, regional edge caches absorb origin load for less popular objects, and Origin Shield adds one more layer for global origins. HTTP/2, HTTP/3 (QUIC), Brotli, automatic gzip, and real-time logging to Kinesis or S3 round out the delivery stack. S3 origins get free fetch and tight integration (Origin Access Control keeps buckets private); ALB and API Gateway origins work with path patterns and multiple origins per distribution.

Cache behavior is where performance is won. The default TTL policy, per-path TTL overrides, origin request policies and cache key composition (headers, query strings, cookies) decide whether your hit ratio is 95% or 40%, and a low hit ratio turns a cheap CDN into an expensive origin relay. We treat cache-key minimization — including only what actually varies responses — as the single highest-value configuration step, and CloudWatch's cache hit-rate metric as the number to watch weekly.

Reliability: the CloudFront SLA (last updated May 5, 2022) commits to 99.9% monthly uptime, measured by internal server error rate in five-minute windows, with service credits for misses. That is lower than what AWS commits for its load balancers (99.99% Multi-AZ), and under the flat-rate plans the uptime SLA only applies from the Business tier up — the Free and Pro plans carry no uptime commitment at all.

Where it falls short

The 99.9% SLA is the first honest complaint. It permits roughly 43 minutes of downtime per month, and the credit mechanism requires you to notice and file. CDN outages are rare but shared-fate: when CloudFront has an incident, it is global, and you have no lever except waiting.

Pricing complexity has doubled rather than simplified. You now model pay-as-you-go against four flat-rate plans, and the flat-rate plans gate features — custom caching rules, logging, private VPC origins and the uptime SLA all start at Business ($200/month) or Premium. A developer on the Pro plan who needs custom cache behaviors discovers the wall at checkout. Regional rate tables plus price classes plus request pricing plus edge compute metering is a lot of arithmetic to answer "what will this cost?"

Configuration surface is deep and unforgiving: distribution invalidations cost extra at scale (the first 1,000 paths per month are free, then charged per path), cache behaviors are ordered and easy to mis-sequence, and default TTL semantics surprise teams serving personalized content. And vendor lock-in bites harder here than with compute — Lambda@Edge functions, KeyValueStore and OAC bindings do not port to other CDNs.

Who should pick this

Our pick for AWS-centric teams that want CDN, WAF and edge compute under one bill and one IAM model. If your origin is S3 or an ALB and you already live in the AWS console, CloudFront is the path of least friction, and the always-free tier covers hobby and small-business traffic outright. Media delivery, software distribution and multi-region SaaS fronting are all squarely in its wheelhouse. It is also our default recommendation for static site hosting on S3 with an OAC binding: cheap, fast, and no server to patch. Teams with compliance requirements around data residency should note that edge caching replicates content to PoPs worldwide unless price classes or geographic restrictions say otherwise — configure restrictions explicitly rather than assuming.

We would not pick it for teams that want one predictable bill without studying rate tables (Cloudflare's flat pricing is the cleaner answer there), for users who need real-time purges at high frequency (invalidation costs and propagation add up), or for anyone whose audience is concentrated in regions where the per-GB tier is $0.110–$0.120 — compare regional CDN pricing first. And if all you need is static asset caching for a small site, the free tier is our pick; do not buy the flat-rate plans until the arithmetic says so.

Key takeaways

• 750+ edge PoPs plus 15 regional edge caches; launched November 2008; IPv6 supported natively.
• Always Free Tier: 1 TB data transfer out, 10M HTTP/HTTPS requests, 2M CloudFront Function invocations and 2M KeyValueStore reads per month.
• Pay-as-you-go after free: $0.085/GB (next 9 TB, US/Canada/Europe), falling to $0.030 at the 524 TB tier; requests $0.0075 per 10,000 HTTP / $0.0100 HTTPS in North America.
• Flat-rate plans ($0 / $15 / $200 / $1,000 per distribution) bundle WAF, DDoS, DNS and edge compute with no overages — but gate custom cache rules, logging and the uptime SLA to the higher tiers.
• Edge compute: CloudFront Functions at $0.10 per 1M invocations, Lambda@Edge at $0.60 per 1M requests plus duration.
• The CloudFront SLA is 99.9% monthly uptime — weaker than AWS's own load balancer SLA, and absent on the Free and Pro flat-rate plans.

Sources

• https://aws.amazon.com/cloudfront/pricing/
• https://aws.amazon.com/cloudfront/pricing/pay-as-you-go/
• https://aws.amazon.com/cloudfront/sla/
• https://aws.amazon.com/about-aws/global-infrastructure/
• https://aws.amazon.com/shield/pricing/
• https://en.wikipedia.org/wiki/Amazon_CloudFront
• https://en.wikipedia.org/wiki/Amazon_Web_Services