CloudFront pricing: the S3 break-even (2026)

Amazon CloudFront costs $0.085 per GB from United States, Mexico and Canada edge locations and $0.120 per GB from Hong Kong, Singapore, South Korea and their neighbours. Serving the same bytes straight out of Amazon S3 costs $0.09 per GB. CloudFront pricing therefore undercuts direct S3 egress in two of its eight geographic groups and costs up to 33% more in the other six, and it charges 2.5 times what S3 charges per request. That is where the break-even lives.

What does CloudFront charge per GB by edge region?

Between $0.085 and $0.120 per GB in the first paid tier, depending on which edge location served the byte. The rates are on the CloudFront pay-as-you-go pricing page, which is no longer the page you land on from aws.amazon.com/cloudfront/pricing. That URL now sells flat-rate plans and carries no per-GB number at all.

Below is CloudFront's "Next 9TB" tier, the first band that costs anything after the free terabyte, against what the same gigabyte costs leaving S3 directly. The S3 pricing page's own worked example states that rate: "The Data Transfer out charge from Amazon S3 in Europe (Ireland) to internet is $0.09 per GB." The VPC pricing page uses the same figure for EC2.

Volume tiers do not pool. The CloudFront FAQ says "your data transfer usage is totaled separately for specific geographic regions, and then cost is calculated based on pricing tiers for each area." Take a hypothetical 18 TB month. All from US edges, 1 TB free, 9 TB at $0.085 and the last 8 TB in the $0.080 band, is $1,405. Split 9 TB US and 9 TB Europe, and every billable gigabyte stays in a first paid tier at $0.085, for $1,445: $40 more for the same bytes.

Is Amazon CloudFront free, and what does the CloudFront free tier cover?

There is a perpetual free tier, and it is large. The pay-as-you-go page lists "1 TB of data transfer out to the internet per month", "10,000,000 HTTP or HTTPS Requests per month" and "2,000,000 CloudFront Function invocations per month" under "Included in Always Free Tier". At US rates that allowance is worth $85 of data transfer plus $10 of requests, so $95 a month, every month, for as long as the account exists.

Three limits on it are in the FAQ. It is one allowance globally, not per region: "The 1 TB data transfer and 10 million Get requests are monthly free tier limits across all Edge locations." It is one per organisation, since "customers that use Consolidated Billing to consolidate payment across multiple accounts will only have access to one Free Tier per Organization". And it covers two meters of the eight: "All other usage types (eg. Invalidations, Proxy requests, Lambda@edge, Origin shield, Data Transfer to Origin etc.) are excluded from the free tier."

Is CloudFront cheaper than serving files straight from S3?

It depends on your average object size, and the crossover is around 120 KB. Two facts set it up. First, getting the bytes from S3 to the edge is free: the pricing page marks data transfer out "Free for origin fetches from any AWS origin such as Amazon Simple Storage Service (S3), Amazon Elastic Compute Cloud (EC2), or Elastic Load Balancers", and the S3 pricing page lists "Data transferred out to Amazon CloudFront (CloudFront)." among the transfers it does not charge for. The FAQ dates it to "December 1, 2014".

Second, requests cost more at the edge than at the bucket. A US HTTPS request is $0.0100 per 10,000, or $1.00 per million. An S3 GET is "$0.0004 per 1,000 requests", or $0.40 per million. Every cache hit swaps a 40-cent-per-million request for a dollar-per-million one, to save half a cent per gigabyte.

The saving is per byte and the penalty is per request, so object size decides which wins. The table is our arithmetic on AWS's US rates, ignoring the free tiers so it describes marginal traffic, and assuming a cache miss costs one extra S3 GET while its bytes ride to the edge free.

Above that line CloudFront wins on price as well as latency. A 5 MB video segment at a 90% hit ratio costs $0.0852 per GB through CloudFront against $0.0901 direct, a 5.4% saving. Below it, a 30 KB web asset at the same hit ratio costs $0.1197 against $0.1033, 16% more, because 33,333 requests per gigabyte swamp a half-cent byte saving. Both are hypothetical, on AWS's US rates.

This is a marginal comparison, not an argument against a CDN. The free terabyte covers a small site outright, latency is not on the table, and the flat-rate plan documentation makes the second-order case: caching "means fewer requests hitting your application servers, databases, and other AWS services that charge based on usage". If the origin is an ALB or an API, the request you did not forward is worth more than the byte. The wider picture is in what AWS data transfer out actually costs.

How much do CloudFront requests cost, and is HTTPS more than HTTP?

HTTPS costs 33% more than HTTP in the US and 37.5% more in South America, per 10,000 requests. The first 10 million a month are free either way.

Nobody should serve HTTP to save $0.0025 per 10,000 requests. The premium matters because it shows that the request meter, not the byte meter, is what a small-object workload pays. Field-level encryption is charged the same way and lands on top: "You pay $0.02 for every 10,000 requests that CloudFront encrypts using field-level encryption in addition to the standard HTTPS request fee", which is twice the US HTTPS request fee it sits on. The field-level encryption guide caps what you get for it: "You can encrypt up to 10 data fields in a request."

What do CloudFront price classes save on a global audience?

Up to 29% per GB, by refusing to use the expensive edges. The distribution settings reference states the default plainly: "Choose the price class that corresponds with the maximum price that you want to pay for CloudFront service. By default, CloudFront serves your objects from edge locations in all CloudFront Regions." The pricing page explains why that costs more: "because we charge more where our costs are higher, this means that you pay more to deliver your content with low latency to end users in some locations."

Price Class 100 keeps only the United States, Mexico, Canada, Europe, Israel and Türkiye. Price Class 200 adds Japan, India, the Middle East, Africa and most of Asia, and drops South America, Australia and New Zealand. The lever is the overflow rule: "In these cases, Amazon CloudFront will only charge you the rate for the least expensive location in your selected price class." A viewer in Singapore is still served. You pay the $0.085 floor instead of $0.120, and they wait longer.

Hypothetically, 10,000 GB a month to Asian viewers above the free tier is $1,200 on Price Class All and $850 at the Price Class 100 floor: $350 a month, $4,200 a year, for a latency decision most teams never revisit. One catch from the FAQ: "You are required to use Price Class All when using Anycast Static IPs." Those cost ten times the ordinary public IPv4 address rate, since "IPv4 addresses provided by AWS are charged $0.05 per IP address per hour", $36 per address over a 720-hour month.

What do CloudFront invalidation requests cost after the first 1,000?

$0.005 per path. The pricing page says "No additional charge for the first 1,000 paths or tags requested for invalidation each month. Thereafter, $0.005 per path or tags requested for invalidation." Three details in the invalidation pricing page decide whether you ever pay it.

A wildcard is one path: it "counts as one path even if it causes CloudFront to invalidate thousands of files". The 1,000 free paths are an account total, not a per-distribution one, and AWS's own example shows the bite: three distributions submitting 600 paths each is 1,800 paths, so "AWS would charge you for 800 invalidation paths in that month", which is $4. And cache tags share the same pot, since "Tag invalidation paths count toward the same 1,000 free invalidation paths per month allowance."

So a team deploying daily with a single /* invalidation pays nothing forever, and a team invalidating 1,000 named files a day pays $145 a month for the identical result. The invalidation path rules hold the trap that pushes teams toward named files: the wildcard "must be the last character in the invalidation path", and an asterisk anywhere else is "treated as a literal character match instead of a wildcard invalidation".

What do CloudFront Functions, Lambda@Edge and Origin Shield cost?

Lambda@Edge is six times a CloudFront Function per invocation and charges for duration on top, so a rewrite that fits in a function should be a function. Origin Shield's US rate matches a US HTTP viewer request, and the Origin Shield guide is precise about when it applies: "You accrue charges for Origin Shield based on the number of requests that go to Origin Shield as an incremental layer." Where the regional edge cache is already in the Origin Shield Region, "Origin Shield will be skipped. You don't accrue Origin Shield charges for these requests." A single-region origin with nearby viewers pays it far less often than the headline rate suggests.

Standard access logs are free to enable and not to deliver. Delivery to CloudWatch Logs bills $0.50 per GB for the first 10 TB after a 750-byte per-request allowance, the meter examined in what CloudWatch Logs really costs. Delivery to S3 carries no delivery charge and costs storage instead, so the S3 storage class minimum durations decide that bill.

What do CloudFront flat-rate pricing plans cost, and who cannot use one?

$0, $15, $200 or $1,000 a month per distribution, and the Premium tier scales to $10,000. Each plan bundles CloudFront with AWS WAF, DDoS protection, Route 53 DNS, CloudWatch Logs ingestion, a TLS certificate and S3 storage credits. The flat-rate documentation is blunt that the allowances are soft: "Usage allowances are not hard limits" and "you will not incur overage charges, regardless of how much you exceed your allowance". Exceed them and you get degradation, not a bill: "we might serve your traffic from fewer or more distant edge locations or adjust performance."

Read the Free row against the free tier above, because they are not the same offer and the flat-rate one is smaller. The Free plan gives 1 million requests and 100 GB per distribution; the pay-as-you-go free tier gives 10 million requests and 1 TB across the account, ten times each. The FAQ keeps them separate: the free tier "applies only to CloudFront usage under pay-as-you-go pricing". At US rates the allowance you hand back is $85.50 a month, against a bundle adding WAF, DNS, DDoS protection and 5 GB of S3 credits. The trade turns on whether you were buying AWS WAF and a Route 53 hosted zone anyway.

Eligibility is where plans get awkward. An account is ineligible if "Your account is using AWS Free Tier", so the two free offers are mutually exclusive by rule, not just arithmetic. A distribution is ineligible if "Your distribution has enabled AWS Shield Advanced", which matters if you already pay what AWS Shield Advanced costs. Real-time logs, Anycast IP lists, continuous deployment, multi-tenant distributions, dedicated IP SSL and field-level encryption each force a distribution back to pay-as-you-go, and the quotas allow 3 free plans per account and 1 apex domain per plan.

Where do AWS's own CloudFront pricing examples contradict each other?

In four places on one page, which is why the worked examples are worth checking before copying a number out of them.

The free request allowance has two values. Example 3 bills 200,000,000 HTTPS requests as "(10,000,000 x $0) + (190,000,000 x $0.01 per 10,000 requests)", or $190. Example 4 bills the same 200,000,000 from a 20,000,000 free allowance, $180. Both prose passages say "after the first 20,000,000". The rate table says "First 10MM HTTP(S) requests" are free and the FAQ agrees. Example 3's chart is right, Example 4's is $10 light, and the prose under both is wrong.

One expression, two answers. Examples 3 and 4 both compute Lambda@Edge duration as "60,000,000ms x 0.01sec x $0.00000625125 per 128 MB-second". Example 3 prints $3.78. Example 4 prints $3.75. The expression evaluates to $3.750750, so Example 4 is right and Example 3 is three cents over, carried into its $1,859.78 total.

Example 1 undercharges its own functions tenfold. The page states "Invocation pricing is $0.10 per 1 million invocations ($0.0000001 per invocation)", and the example's prose repeats it, "then you will be charged at $0.1 per million requests". Its chart then computes "(12,000,000 – 2,000,000) x $0.01 per 1,000,000 requests" and prints $0.10. At the stated rate that is $1.00. The same example describes 1,000,000 requests with two functions each, which is 2,000,000 invocations, not 12,000,000, and 2,000,000 is exactly the free allowance.

The saving in Example 2 is priced at the wrong rate. Its closing note says you can put CloudFront in front of AWS origins "to deliver HTTP(S) objects and save on DTO costs, roughly $77 in this example." The example moves 1 TB. At the $0.09 per GB AWS's own S3 pricing page quotes, 1,000 GB is $90, or $81 after the global allowance of "100GB of data transfer out to the internet free each month, aggregated across all AWS Services and Regions (except China and GovCloud)". The only clean reconstruction of $77 is 900 GB at CloudFront's own $0.085 edge rate, $76.50. The saving is real, and AWS has understated its own case.

There is a structural version of the same problem. The invalidation pricing page, the Origin Shield guide and the distribution settings reference all send readers to aws.amazon.com/cloudfront/pricing/ for a rate, and that page no longer publishes rates. Until those links are fixed the numbers live one click on, at /pricing/pay-as-you-go/. Check yours against your own line items rather than a worked example, the way Cost Explorer and the CUR disagree about where a charge belongs.