Amazon CloudFront: pricing, price classes and how to cut the bill

Amazon CloudFront delivers content from a worldwide network of edge locations and bills each GB it sends and each request it answers, at the rates of the geographic group of the edge location that serves the viewer. Two other bills sit beside that one: the origin's, which a good cache shrinks, and a flat-rate plan's, which can replace the pay-as-you-go bill of a distribution altogether. This article explains how CloudFront works under the hood, how CloudFront pricing works line by line and how to reduce CloudFront costs, with the list prices of CloudFront's edge locations and of origins in the Paris Region (eu-west-3), and prices four architectures before and after the levers.

What Amazon CloudFront is

In AWS's words, "Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations." What you configure is a distribution: "You create a CloudFront distribution to tell CloudFront where you want content to be delivered from, and the details about how to track and manage content delivery." What an edge location does not have, CloudFront fetches "from an origin that you've defined—such as an Amazon S3 bucket, a MediaPackage channel, or an HTTP server (for example, a web server) that you have identified as the source for the definitive version of your content", and "There is no additional charge to use a custom origin". Each part of a distribution moves a different line of the bill:

The pay model has two forms. Pay-as-you-go first: "Like other AWS services, Amazon CloudFront is a self-service, pay-per-use offering, requiring no long term commitments or minimum fees", and in the developer guide's own summary, "CloudFront charges for data transfers out from its edge locations, along with HTTP or HTTPS requests. Pricing varies by usage type, geographical region, and feature selection." Then the plans: "CloudFront flat-rate pricing plans combine the Amazon CloudFront global content delivery network (CDN) with multiple AWS services and features into a monthly price with no overage charges, regardless of traffic spikes or attacks". The free tier is left out of the computed bills and priced once, in its own section.

How CloudFront works under the hood

AWS documents CloudFront at the level of edge locations, regional edge caches, Origin Shield, the cache key, the time to live and what goes to the origin. It does not document the cache servers themselves, their storage or how routing picks one location over another, so this article does not either. Each part it does document is a line of the bill, or decides one.

Edge locations, and how a viewer reaches one

"CloudFront Points of Presence are situated within the AWS network and peer with internet service provider (ISP) networks. CloudFront has 750+ POPs in 100+ cities across 50+ countries". A request starts with DNS: "DNS routes the request to the CloudFront POP (edge location) that can best serve the request, typically the nearest CloudFront POP in terms of latency", and "CloudFront speeds up the distribution of your content by routing each user request through the AWS backbone network to the edge location that can best serve your content" (What is Amazon CloudFront?). Inside the ISPs' own networks sit embedded POPs:

They are "an opt-in capability intended for the delivery of large scale cacheable traffic", "custom built to deliver large scale live-streaming events, video-on-demand (VOD), and game downloads", and there is "no additional charge for using CloudFront embedded POPs".

The edge location decides the rates. CloudFront's data and request usage types carry a two-letter code for where they were served, from "EU: Europe and Israel" to "ZA: South Africa" (Interpret your AWS bill and usage reports for CloudFront), and the FAQ adds that "your data transfer usage is totaled separately for specific geographic regions, and then cost is calculated based on pricing tiers for each area." A viewer is billed where it is served, not where it lives: price classes change which edge locations may serve it.

A request's path: hit, miss and the regional edge caches

"CloudFront checks its cache for the requested object. If the object is in the cache, CloudFront returns it to the user." If it is not, CloudFront "compares the request with the specifications in your distribution and forwards the request to your origin server for the corresponding object" (How CloudFront delivers content), and it does not wait for the whole file: "As soon as the first byte arrives from the origin, CloudFront begins to forward the object to the user. CloudFront also adds the object to the cache for the next time someone requests it." Between the edge locations and the origin sits a second layer, the regional edge caches, "located between your origin server and the POPs—global edge locations that serve content directly to viewers":

Scroll the diagram sideways →

"Regional edge caches have a larger cache than an individual POP, so objects remain in the cache longer at the nearest regional edge cache location." On a miss, "the POP typically goes to the nearest regional edge cache to fetch it", and what comes back from the origin is cached at both levels: "This makes sure that all of the POPs in a region share a local cache, eliminating multiple requests to origin servers." Some requests skip that layer: "Proxy HTTP methods (PUT, POST, PATCH, OPTIONS, and DELETE) go directly to the origin from the POPs and do not proxy through the regional edge caches", "Dynamic requests, as determined at request time, do not flow through regional edge caches, but go directly to the origin", and "When the origin is an Amazon S3 bucket and the request's optimal regional edge cache is in the same AWS Region as the S3 bucket, the POP skips the regional edge cache and goes directly to the S3 bucket." The layer costs nothing extra, in the FAQ's words: "There are no additional charges to use this feature." Simultaneous misses are merged too: "Amazon CloudFront also uses techniques such as collapsing simultaneous viewer requests at an edge location for the same file into a single request to your origin server."

The share of requests served from a cache has a name: "The proportion of requests that are served directly from the CloudFront cache compared to all requests is called the cache hit ratio". A hit brings, in AWS's words, "Reduced load on your origin server" and "Reduced latency for the viewer" (Control the cache key with a policy). What it does not change is CloudFront's data out and requests: the price list prices each viewer request and each GB delivered, with no rate for a hit or for a miss. Two CloudFront fees are charged on misses only, and shrink as the hit ratio grows: Origin Shield's request fee, whose formula AWS multiplies by "(1 – cache hit rate)" (Origin Shield), and a Lambda@Edge function on origin events, since on an origin request "When the requested object is in the CloudFront cache, the function doesn't execute" (CloudFront events that can trigger a Lambda@Edge function). So, read from the price list, the cache hit ratio lowers the origin's bill, and CloudFront's only where those two are configured:

A · CACHE HIT

CloudFront

The request and the bytes delivered, at the edge location's rates

The origin

Nothing: no request, no compute, no load balancer capacity

From the origin to CloudFront

Nothing travels

The viewer

Lower latency

B · CACHE MISS

CloudFront

The same request and bytes, at the same rates, plus Origin Shield's request fee and Lambda@Edge on origin events, where configured

The origin

A request, its compute, its load balancer capacity

From the origin to CloudFront

Free from an AWS origin ($0.00 per GB out of Paris); billed by the provider of an origin outside AWS

The viewer

The time of the fetch

What differs: the origin's bill and the latency; CloudFront's data out and requests are the same for a hit and a miss, and only its fees on misses, Origin Shield and Lambda@Edge on origin events, fall with the hit ratio.

Origin Shield, one more cache in front of the origin

"CloudFront Origin Shield is an additional layer in the CloudFront caching infrastructure that helps to minimize your origin's load, improve its availability, and reduce its operating costs". "When you use Origin Shield, all requests from all of the CloudFront caching layers to your origin go through Origin Shield, increasing the likelihood of a cache hit. Requests that are made in the same Region as your origin will bypass Origin Shield." Its own misses are merged: "Requests for content that is not in Origin Shield's cache are consolidated with other requests for the same object, resulting in as few as one request going to your origin", which "can reduce costs for things like just-in-time packaging, image transformations, and data transfer out (DTO)."

It is set per origin, "Origin Shield is a property of the origin", in one of the Regions where CloudFront has a regional edge cache: "You should choose the AWS Region that has the lowest latency to your origin", and for an origin in such a Region, "enable Origin Shield in the same Region as your origin." Europe (Paris) is in that list, but the AWS Price List has no Origin Shield row for it: this article prices Origin Shield at its Frankfurt, Ireland and London rows and gives Paris no number (Origin Shield, invalidations, edge compute and logs). AWS names the cases on each side:

How it is billed, with two examples, is in the pricing section.

The cache key and the time to live: what makes a hit

"The cache key is the unique identifier for every object in the cache, and it determines whether a viewer's HTTP request results in a cache hit", and "Including fewer values in the cache key increases the likelihood of a cache hit." The rule for what goes in it (Understand the cache key): "When a value in the viewer request determines the response that your origin returns, you should include that value in the cache key. But if you include a value in the cache key that doesn't affect the response that your origin returns, you might end up caching duplicate objects." Cookies multiply the copies: "For the cookies that you configure CloudFront to forward to your origin, CloudFront forwards every combination of cookie name and value. It then separately caches the objects that your origin returns, even if they're all identical"; with two cookies of three values each, "CloudFront forwards up to nine different requests to your origin for each object" (cache hit ratio). The same page asks to "forward only the query string parameters for which your origin will return unique objects" and to "avoid caching based on request headers that have large numbers of unique values". What the origin needs to see without splitting the cache goes in an origin request policy: "Origin request policies are separate from cache policies, which control the cache key. This way, you can receive additional information at the origin and also maintain a good cache hit ratio".

How long an object stays: "By default, each file stays in an edge location for 24 hours before it expires. The minimum expiration time is 0 seconds; there isn't a maximum expiration time", and "To increase your cache hit ratio, you can configure your origin to add a Cache-Control max-age directive to your objects, and specify the longest practical value for max-age" (cache hit ratio). A long time to live is a ceiling, not a promise: "If a file in an edge location isn't frequently requested, CloudFront might evict the file—remove the file before its expiration date—to make room for files that have been requested more recently". Two of the managed cache policies set both at once:

The bill sees the time to live too. Usage types split the bytes and requests of objects cached an hour or more from the others, at the same price (Interpret your AWS bill), and Origin Shield counts "GET and HEAD requests that have a time to live (TTL) setting of less than 3600 seconds" among its dynamic requests, each of which it bills (Use Amazon CloudFront Origin Shield).

What reaches the origin, and what it costs

Fetches from an AWS origin are not billed: "Free for origin fetches from any AWS origin such as Amazon Simple Storage Service (S3), Amazon Elastic Compute Cloud (EC2), or Elastic Load Balancers, including origins in private subnets through VPC origins". The rest of the traffic between CloudFront and an origin is billed by someone, in the pricing page's words:

A 304 is not free either: "A 304 is a response to a conditional GET request and will result in a charge for the HTTP/HTTPS request and the Data Transfer Out to Internet". And compression happens at the edge, on the very bytes CloudFront bills: "the cost of CloudFront data transfer is based on the total amount of data served. Serving compressed objects can be less expensive than serving them uncompressed".

CloudFront Functions and Lambda@Edge

Code can run at the edge in two ways, limited and priced differently (Differences between CloudFront Functions and Lambda@Edge, pay-as-you-go pricing):

A · CLOUDFRONT FUNCTIONS

Made for

Cache key normalization, header manipulation, URL redirects or rewrites, request authorization

Scale

Up to millions of requests per second, each in under a millisecond, with 2 MB of memory

Price

$0.10 per million invocations, the first 2 million a month free

On a flat-rate plan

Included

B · LAMBDA@EDGE

Made for

Functions that take several milliseconds or more, that call external services over the network, or that read the body

Scale

Up to 10,000 requests per second per Region

Price

$0.60 per million requests run in Paris, plus the duration per GB-second; no free tier

On a flat-rate plan

Billed on a pay-as-you-go basis

What differs: per million calls, $0.10 against $0.60 before Lambda@Edge's duration, and what the code may do in that time.

For 100 million invocations a month, CloudFront Functions cost $10.00, the free 2 million not deducted; Lambda@Edge costs $60.00 in requests, plus its duration at $0.00005001 per GB-second in Paris: $0.63 at 1 ms with 128 MB of memory, $3.13 at 5 ms, $6.25 at 10 ms, computed. Lambda@Edge does not run at the edge location itself but "in a regional edge cache (usually in the AWS region closest to the CloudFront edge location reached by the client)", and "There is no free tier for Lambda@Edge at this time." Lambda@Edge is "an extension of AWS Lambda", billed like it per request and per GB-second; the AWS Lambda article prices Lambda itself in Paris.

What CloudFront is used for

AWS's ways to use CloudFront, with the cases its FAQ, its pricing page and the S3 guide add, each move a different line of the bill:

The fifth row is the CloudFront FAQ's "frequently accessed static content that benefits from edge delivery", the sixth the pricing page's, which also says "Your content can be static, dynamically generated and cacheable, or non-cacheable content — all three will benefit from improved performance, security, and availability." The last is the S3 website hosting guide's, for a website whose bucket uses SSE-KMS.

CloudFront, or data straight out of the origin

Serving viewers through CloudFront instead of straight from an S3 bucket, an instance or a load balancer in Paris changes two lines. The first is the price per GB: CloudFront's Europe edge locations bill less than data out of Paris at every tier, and the gap widens with volume:

The two ladders do not count the same GB. Paris's tiers add up the account's data out across services, since "Rate tiers take into account your aggregate usage for Data Transfer Out to the Internet across Amazon EC2, Amazon S3" and the other services the page lists (the EC2 article lists data out of Paris with EC2's other charges); CloudFront's add up each geographic group's GB on its own. The second line goes the other way: an HTTPS request through CloudFront in Europe costs $0.012 per 10,000 requests, 2.86 times an S3 GET request in Paris, computed, and a load balancer bills its capacity units, not requests (Elastic Load Balancing pricing). So the object size decides, at the first tiers:

How to read it: above that size, the saving per GB outweighs the request fee. For the load balancer, processed bytes are taken as its highest capacity dimension, so each GB it no longer processes also saves one LCU-hour of capacity, $0.0084, which is why caching moves its break-even so far. The S3 article works the same sums for public reads, and AWS's own sentence says when the GB wins:

Using CloudFront can be more cost effective if your users access your objects frequently because, at higher usage, the price for CloudFront data transfer is lower than the price for Amazon S3 data transfer.

Price is not AWS's only argument. Its pricing page says CloudFront "delivers fast experiences by shortening and eliminating costly round trips to establish connections in region, including for dynamic, uncacheable workloads like APIs" (Amazon CloudFront pricing); this article does not price latency. And a flat-rate plan changes the sums again: within its allowance, a request costs nothing more.

In short: Through CloudFront, a GB from Europe costs less than the same GB out of Paris at every tier, and a request costs more than an S3 GET: large objects come out ahead, small ones can cost more on pay-as-you-go, and a flat-rate plan removes the request fee within its allowance.

How CloudFront pricing works

What a CloudFront bill is made of

The pay-as-you-go pricing page lists more charges than the FAQ's "five areas", and this article follows the page. Line by line:

"There is no additional charge for sending data over WebSocket or gRPC protocols", the page adds. Put together, a small month looks like this:

Data out, by geographic group

There is no Paris price for CloudFront: the price list prices its data out by the geographic group of the edge location, eight groups on the pricing page and ten codes on the bill. "Usage tiers for data transfer are measured separately for each geographic region" (Amazon CloudFront FAQs). At the first tier, the groups of Price Class 100 cost least. The chart puts each group under the price class that adds it, cheapest first within each:

A TB a month costs $87.04 from Europe or North America and $122.88 from Asia Pacific, computed: per GB, Asia Pacific costs 41.2% more than Europe and Japan 34.1% more. The groups do not fall at the same pace with volume, and their requests are not all priced alike (the rows in the chart's order):

An HTTPS request costs 16.7% less in North America than in Europe, and 83.3% more in South America, computed. Europe's ladder goes further than the table, down to $0.02 per GB over 5 PB a month (the chart of the previous section shows every rung). Below the list, "Customers willing to make minimum traffic commits of typically 10 TB/month or higher are eligible for discounted pricing" (pay-as-you-go pricing); no such price is in the Price List, so none is given here.

Requests, and data sent to the origin

"You will be charged for number of HTTP/HTTPS requests made to Amazon CloudFront for your content" (Amazon CloudFront FAQs). The price list splits GET and HEAD requests from the methods CloudFront forwards to the origin, "Number of HTTPS DELETE, OPTIONS, PATCH, POST, and PUT requests that CloudFront forwards to your origin or edge function" (Interpret your AWS bill); in Europe both cost $0.012 per 10,000 requests over HTTPS. HTTP requests cost $0.009 per 10,000 requests, but serving over HTTP to save on requests gives up the encryption of every request, and this article does not suggest it. The bodies those methods carry are billed as data to the origin: $0.02 per GB from Europe and North America; $0.06 per GB from Japan, Asia Pacific, and the Middle East, South Africa, Kenya, Nigeria and Egypt; $0.08 per GB from Australia; $0.125 per GB from South America; and $0.16 per GB from India. The free tier does not cover them: "All other usage types (eg. Invalidations, Proxy requests, Lambda@edge, Origin shield, Data Transfer to Origin etc.) are excluded from the free tier."

Price classes

"Price classes provide you an option to lower the prices you pay to deliver content out of Amazon CloudFront. By default, Amazon CloudFront minimizes end-user latency by delivering content from its entire global network of edge locations. However, because we charge more where our costs are higher, this means that you pay more to deliver your content with low latency to end users in some locations". There are three, one inside the other:

Scroll the diagram sideways →

The bill follows the edge location that serves: "You will only be charged fees specific to the edge locations from which the content was actually delivered within the selected price class. From time to time, your content may be served from an edge location that is not included in your price class. In these cases, Amazon CloudFront will only charge you the rate for the least expensive location in your selected price class." The price is latency: "some of your viewers, especially those in geographic locations that are not in your price class, may experience higher latency than if your content were being served from all Amazon CloudFront locations." The setting is per distribution: "Choose the price class that corresponds with the maximum price that you want to pay for CloudFront service. By default, CloudFront serves your objects from edge locations in all CloudFront Regions". One feature needs the whole network: for Anycast static IPs, "you must select Use all edge locations for the price class for the distribution". Which edge location of a smaller class serves a viewer from outside it is AWS's routing, not a documented table, so pattern 3 states its assumption and tries another.

Flat-rate plans

The plans sell a distribution by the month instead of by the GB and the request. "Flat-rate pricing plans include the following features for a simple monthly price": the CloudFront CDN, AWS WAF and DDoS protection, bot management and analytics, Amazon Route 53 DNS, Amazon CloudWatch Logs ingestion, a TLS certificate, serverless edge compute and Amazon S3 storage credits each month. "Plans don't require an annual commitment to get the best available rates", "Each pricing plan covers one CloudFront distribution with up to one apex (root) domain", and the price does not change with geography: "Each flat-rate plan includes global content delivery for one simple price" (Amazon CloudFront FAQs). The plans have an offer of their own in the AWS Price List, with their prices and their allowances, nine levels from Free to Premium at its 600 TB level:

The last column prices the whole allowance, data on the Europe ladder and HTTPS requests, so it is what the allowance's data and requests cost at the Europe rates. Served from costlier groups, or with the web ACL, the hosted zone and the log ingestion a plan also covers, the same usage costs more on pay-as-you-go. A distribution uses part of its allowance, and the comparison that counts is with its own pay-as-you-go bill, as in the patterns. Each plan also gives S3 storage credits, 5 GB on Free, 50 GB on Pro, 1 TB on Business and 5 TB on Premium, "that offset any S3 Standard storage costs in your AWS account", and 5, 25, 50 and 75 AWS WAF rules. The allowance is not a cap:

Most importantly: you will not incur overage charges, regardless of how much you exceed your allowance.

What happens instead is spelled out (flat-rate pricing plans): "Usage allowances are not hard limits —they represent the baseline usage your plan is designed to support", "Your first traffic spike up to 3x your monthly allowance won't affect your service that month", and "Sustained usage above your allowance is evaluated over 2-3 months or more, not immediately", after which "your traffic might be served from fewer or more distant edge locations, or performance might be adjusted." Attacks do not count: "Blocked DDoS attacks and requests blocked by AWS WAF never count against your usage allowance."

The plan covers "Your CloudFront distribution", the web ACL with "custom rules, AWS Managed Rules, and request fees for the web ACL associated with your distribution", CloudWatch Logs ingestion of the access and WAF logs, and "The Route 53 hosted zone, DNS records, and DNS queries when attached to your distribution's plan"; invalidations and serverless edge compute are included too (Amazon CloudFront FAQs). Lambda@Edge, additional CloudWatch metrics and Parquet access logs stay billed. The conditions are strict:

The last row is the pricing page's. Eligibility follows history: "If your recent usage exceeds a plan tier's usage allowances, you might need to select a higher tier that better aligns with your workload." Upgrades take effect at once, "Your price and usage allowance are prorated", and a cancelled plan keeps its price "through the end of your current billing cycle." AWS's own advice on the choice: "Flat-rate plans are ideal if you want combined monthly billing, simplified service configuration, and built-in security features without worrying about overage charges. Pay-as-you-go pricing is a better choice if you need complete control over individual service features, custom configurations, access to features not available in flat-rate plans, or if you expect to handle large, predictable traffic spikes."

Origin Shield, invalidations, edge compute and logs

The other CloudFront charges in the price list:

Origin Shield is a request fee: "Origin Shield is charged as a request fee for each request that comes from another regional cache to your Origin Shield", and "request fees are charged based on the AWS Region you have configured to be your Origin Shield Region and not based on the Amazon CloudFront edge location serving content" (pay-as-you-go pricing); the data into Origin Shield is not billed. AWS gives the formulas (Use Amazon CloudFront Origin Shield):

The two examples are assumptions to show the shape: the fee is small on cacheable traffic and grows with dynamic traffic, which AWS says Origin Shield may not suit. "For requests that naturally go to the regional edge cache in the same Region as Origin Shield, Origin Shield will be skipped. You don't accrue Origin Shield charges for these requests."

Invalidations are counted by path (Pay for file invalidation): "The first 1,000 invalidation paths that you submit per month are free; you pay for each invalidation path over 1,000 in a month", "A path that includes the * wildcard counts as one path even if it causes CloudFront to invalidate thousands of files", and "The maximum of 1,000 free invalidation paths per month applies to the total number of invalidation paths across all of the distributions that you create with one AWS account." Bundling does not help, "each path is still counted individually for billing purposes", and "Tag invalidation paths count toward the same 1,000 free invalidation paths per month allowance."

Logs. "CloudFront doesn't charge for enabling standard logs" (standard logging), and "For each CloudFront request, you get 750 bytes of logs delivery to CloudWatch Logs at no additional charge" (pay-as-you-go pricing); real-time access logs bill each line, and "CloudFront charges for real-time access logs, in addition to the charges you incur for using Kinesis Data Streams" (real-time access logs):

A · STANDARD LOGS

CloudFront's charge

None to enable them

Delivery

To Amazon S3, at the bucket's storage and request prices; to CloudWatch Logs, 750 bytes per request included

On a flat-rate plan

CloudWatch Logs ingestion of the access logs included

B · REAL-TIME ACCESS LOGS

CloudFront's charge

$0.01 per million log lines

Delivery

To Kinesis Data Streams, billed on top

On a flat-rate plan

Not supported

What differs: a free switch and a delivery bill, against a fee per line on top of a stream.

For 100 million log lines a month, the real-time fee is $1.00, computed, before Kinesis Data Streams. The default metrics are free, and "you can turn on additional metrics for an additional cost", the cache hit rate among them, billed by CloudWatch and not priced here.

Certificates and addresses. The free tier lists free SSL certificates, and SNI is the way AWS recommends to serve them: "SNI Custom SSL is available at no additional cost beyond standard CloudFront data transfer and request fees", while "If you configure CloudFront to serve HTTPS requests using dedicated IP addresses, you incur an additional monthly charge". What each option of this line adds:

Where a certificate lives is a rule, not a cost: "To use an ACM certificate with a CloudFront distribution, make sure you request (or import) the certificate in the US East (N. Virginia) Region (us-east-1)", except for the certificate between CloudFront and a load balancer origin, where "you can request or import the certificate in any AWS Region". VPC origins save on addresses too: "VPC origins also allows you to optimize your IPv4 costs by allowing you to route to origins in a private subnet with internal IPv4 IP addresses which free of cost" (Amazon CloudFront FAQs).

The free tier, the Security Savings Bundle and custom pricing

The CloudFront FAQs give the free tier: "Starting Dec 1 2021, all AWS customers will receive 1 TB of data transfer out, 10,000,000 HTTP/HTTPS requests, plus 2,000,000 CloudFront Functions invocations each month for free." It comes back every month, it counts "across all Edge locations", and "customers that use Consolidated Billing to consolidate payment across multiple accounts will only have access to one Free Tier per Organization." At the Europe rates its data and requests are worth $99.04 a month, computed: the month of the receipt above. This article does not deduct it from any bill. It is not the Free plan: "The CloudFront Free Tier is different – it applies only to CloudFront usage under pay-as-you-go pricing."

Two discounts sit outside the Price List, so neither gets a number here, only AWS's own:

The CloudFront Security Savings Bundle "helps you save up to 30% on your CloudFront bill in exchange for making a commitment to a consistent amount of monthly usage", "for a 1 year term", with up to 10% of the commitment in AWS WAF usage included; it is bought "only through the CloudFront console", and "CloudFront Security Savings Bundle savings do not apply to CloudFront flat-rate pricing plans." Custom pricing is a contract: "Custom discounted pricing is available for customers willing to commit to a minimum of 10 TB of data transfer per month for 12 months or longer. Discounts vary based on the amount of the commitment", and of the bundle and custom pricing, "You may only be subscribed to one or the other."

Reading the CloudFront lines of a bill

On the bill, "On the Charges by service tab, choose CloudFront, and then expand Global or the AWS Region name"; the usage report "lists operations by region and usage type". The usage types carry the location code, EU- for Europe (Interpret your AWS bill, and the price list):

The origin's side is not under CloudFront: "This table doesn't include charges for transferring your objects from an Amazon S3 bucket to CloudFront edge locations. These charges, if any, appear in the AWS Data Transfer portion of your AWS bill." In Cost Explorer they are usage type groups such as "EC2: Data Transfer - CloudFront (Out)" and "S3: Data Transfer - CloudFront (Out)". Per distribution, the usage report has a "Resource – Either the ID of the CloudFront distribution associated with the usage or the certificate ID of an SSL certificate", and distributions take cost allocation tags, though "you can't tag origin access identities or invalidations" (Tag a CloudFront resource).

In short: A CloudFront bill is data out and requests by geographic group, plus fees that start small and grow with use: Origin Shield on dynamic traffic, invalidation paths past 1,000, Lambda@Edge, real-time logs; a flat-rate plan replaces the data, the requests, the web ACL and the hosted zone with one monthly price, under conditions.

Architecture patterns around CloudFront and what they cost

Four illustrative configurations, each priced before and after the levers of the next section, line by line from the AWS Price List: large downloads from S3, a web application of small responses behind a load balancer, a worldwide audience, and deploys that invalidate too much. Each answers one question: CloudFront or data straight out of S3, a flat-rate plan or pay-as-you-go, which price class, and the fee teams forget. None is a client case; every amount is computed, and each card lists its assumptions and what it leaves out. The EC2 patterns price the instances that sit behind such a distribution.

Pattern 1 of 4 · Illustrative configuration

Downloads from an S3 bucket in Paris

A software vendor serves 40 TB a month of installers from an S3 bucket in Paris to viewers in Europe: straight from the bucket, through CloudFront on pay-as-you-go, or through the same distribution on a flat-rate plan.

Scroll the diagram sideways →

At 256 MiB a file, the request fees are cents and the price per GB carries the bill: through CloudFront, $3,340.20 against $3,544.87 straight from the bucket, computed. The same distribution on the Pro plan costs $25.80 a month with its S3 storage credit, 99.3% less than straight from the bucket, computed, as long as it meets the plans' conditions. The chart in this card shows where pay-as-you-go stops paying off: with small objects, the request fees win.

Before · Straight from a public S3 bucket$3,544.87

With the levers · Through CloudFront, bucket private, pay-as-you-go$3,340.20

• Storage$12.00 → $12.00, too small to draw
• Network$3,532.80 → $3,328.20, too small to draw
• Other$0.07 → —, too small to draw

Before · Straight from a public S3 bucket: storage $12.00, network $3,532.80, other $0.07, total $3,544.87 a month.

With the levers · Through CloudFront, bucket private, pay-as-you-go: storage $12.00, network $3,328.20, other $0.00, total $3,340.20 a month.

With the levers: $204.67 a month less (5.8% less), computed.

1 TB a month to viewers in Europe by object size: straight from S3 in Paris, or through CloudFront with 95% of requests from the cache, computed

• Straight from S3
• Through CloudFront, 95% hits

Object size		From S3, a month	Through CloudFront, a month	Change, computed
16 KiB67,108,864 requests		$120.35	$168.98	40.4% more
64 KiB16,777,216 requests		$99.21	$107.52	8.4% more
128 KiB8,388,608 requests		$95.68	$97.29	1.7% more
256 KiB4,194,304 requests		$93.92	$92.16	1.9% less
512 KiB2,097,152 requests		$93.04	$89.60	3.7% less
1 MiB1,048,576 requests		$92.60	$88.32	4.6% less

CloudFront costs less from about 168.0 KiB per object at a 95% hit ratio, computed: its data out costs less per GB, its requests more than S3's GET requests. The pattern's files are 256 MiB, far to the right of these sizes.

USD, before tax. AWS Price List, eu-west-3, Europe edge locations and global, offer files published September 11, 2026, September 16, 2026, October 3, 2026 and October 15, 2026, fetched October 16, 2026.

Levers

• Keep the origin private, so every byte goes through CloudFront
• Put a distribution on a flat-rate plan when it fits

The bills line by line, the assumptions and the sources

Downloads from an S3 bucket in Paris, before: Straight from a public S3 bucket Illustrative

Viewers download from the bucket: S3 bills data out of Paris to the internet and every GET request.

Line	A month
Storage
S3 Standard storage500 GB × $0.024 /GB-mo	$12.00
Network	$3,532.80
Data out of Paris to the internet, first 10 TB10,240 GB × $0.09 /GB	$921.60
Data out of Paris to the internet, next 40 TB30,720 GB × $0.085 /GB	$2,611.20
Other
S3 GET requests163,840 requests × $0.00042 /1K req	$0.07
A month, computed	$3,544.87

Downloads from an S3 bucket in Paris, with the levers: Through CloudFront, bucket private, pay-as-you-go Illustrative

A CloudFront distribution in front of the bucket, which only the distribution can read (origin access control); CloudFront bills its data out and its requests at its Europe edge locations' rates.

Line	A month
Storage
S3 Standard storage500 GB × $0.024 /GB-mo	$12.00
Network	$3,328.20
CloudFront data out, Europe, first 10 TB10,240 GB × $0.085 /GB	$870.40
CloudFront data out, Europe, next 40 TB30,720 GB × $0.08 /GB	$2,457.60
CloudFront HTTPS requests, Europe163,840 requests × $0.012 /10K req	$0.20
Data out of Paris to CloudFront, cache misses2,048 GB × $0.00 /GB	$0.00
Other
S3 GET requests on cache misses8,192 requests × $0.00042 /1K req	$0.00
A month, computed	$3,340.20

The same distribution on the Pro flat-rate plan: $25.80 a month, 99.3% less than before, computed.

Assumptions

• Illustrative configuration in Paris (eu-west-3), not a client case.
• 40,960 GB (40 TB) a month of files of 256 MiB on average: 163,840 downloads, each one GET request; viewers in Europe only, so CloudFront bills its Europe edge locations' rates.
• Through CloudFront, 95% of the requests are cache hits (an assumption): 8,192 requests and 2,048 GB a month reach the bucket.
• The bucket stores 500 GB in S3 Standard in every variant.
• The account has no other data transfer out to the internet in Paris and no other CloudFront traffic, so each tier counts this workload only.
• On the Pro plan, the distribution stays within its monthly allowance of 10 million requests and 50 TB, and the plan's 50 GB of S3 storage credit offsets 50 GB of S3 Standard storage. The account is not on the AWS Free Tier and the distribution meets the plan's conditions.

Not counted

• The CloudFront free tier (1 TB and 10 million requests a month) and the 100 GB a month of data out to the internet that AWS does not charge across services.
• Download managers that split a file into ranges, which multiply the requests.
• S3 PUT requests for the uploads, the same in every variant, and AWS KMS.
• The AWS WAF web ACL a flat-rate plan requires, which the plan includes.

Sources

• Amazon CloudFront pay-as-you-go pricing
• Amazon S3 pricing
• Restrict access to an Amazon S3 origin
• CloudFront flat-rate pricing plans
• Amazon CloudFront FAQs
• Performance design patterns for Amazon S3

USD before tax, 730 h a month. AWS Price List, eu-west-3, Europe edge locations and global, offer files published September 11, 2026, September 16, 2026, October 3, 2026 and October 15, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.

Pattern 2 of 4 · Illustrative configuration

A web application behind a load balancer: pay-as-you-go or the Business plan

A web application in Paris behind an Application Load Balancer serves 10 TB a month to viewers in Europe through CloudFront, with an AWS WAF web ACL: the same distribution on pay-as-you-go and on the Business flat-rate plan, against no CloudFront at all.

Scroll the diagram sideways →

On pay-as-you-go, the requests cost $120.80 a month, two thirds of them for 32 KiB answers, and cancel CloudFront's cheaper GB: without the web ACL and the hosted zone, the setup costs $1,031.18 with its load balancer, 0.4% more than sending every viewer straight to the load balancer ($1,026.95), computed. Putting only the static files through CloudFront costs $960.89, 6.4% less than the load balancer alone. The plan changes the comparison: $239.98 with the web ACL and the hosted zone, 76.6% less than the load balancer alone, computed.

Before · CloudFront pay-as-you-go, with an AWS WAF web ACL$1,102.08

With the levers · The same distribution on the Business flat-rate plan$239.98

• Network$1,031.18 → $239.98, too small to draw
• Other$70.90 → —, too small to draw

Before · CloudFront pay-as-you-go, with an AWS WAF web ACL: network $1,031.18, other $70.90, total $1,102.08 a month.

With the levers · The same distribution on the Business flat-rate plan: network $239.98, total $239.98 a month.

With the levers: $862.10 a month less (78.2% less), computed.

Levers

• Put a distribution on a flat-rate plan when it fits
• Raise the cache hit ratio with a lean cache key and long TTLs
• Weigh request fees against the cheaper GB

The bills line by line, the assumptions and the sources

A web application behind a load balancer: pay-as-you-go or the Business plan, before: CloudFront pay-as-you-go, with an AWS WAF web ACL Illustrative

CloudFront bills its data out and its requests, AWS WAF its web ACL, rules and requests, Route 53 the hosted zone.

Line	A month
Network	$1,031.18
CloudFront data out, Europe, first 10 TB10,240 GB × $0.085 /GB	$870.40
CloudFront HTTPS requests, Europe100,663,296 requests × $0.012 /10K req	$120.80
Application Load Balancer hours1 load balancer × 730 h × $0.02646 /h	$19.32
Load balancer capacity units, 2,457.6 GB processed3.37 LCU × 730 h × $0.0084 /LCU-h	$20.66
Data out of Paris to CloudFront2,457.6 GB × $0.00 /GB	$0.00
Other	$70.90
AWS WAF web ACL1 web ACL × $5.00 /mo	$5.00
AWS WAF rules5 rules × $1.00 /mo	$5.00
AWS WAF requests100.66 M requests × $0.60 /M req	$60.40
Route 53 hosted zone1 hosted zone × $0.50 /mo	$0.50
A month, computed	$1,102.08

A web application behind a load balancer: pay-as-you-go or the Business plan, with the levers: The same distribution on the Business flat-rate plan Illustrative

One monthly price covers the distribution, its AWS WAF web ACL and its requests, and the hosted zone attached to the plan; the load balancer is billed as before.

Line	A month
Network	$239.98
CloudFront Business flat-rate plan1 plan × $200.00 /mo	$200.00
Application Load Balancer hours1 load balancer × 730 h × $0.02646 /h	$19.32
Load balancer capacity units, 2,457.6 GB processed3.37 LCU × 730 h × $0.0084 /LCU-h	$20.66
Data out of Paris to CloudFront2,457.6 GB × $0.00 /GB	$0.00
A month, computed	$239.98

Same distribution, pay-as-you-go, without the web ACL and the hosted zone: $1,031.18 a month, 6.4% less than before, computed.

No CloudFront: viewers straight to the load balancer: $1,026.95 a month, 6.8% less than before, computed.

Static files through CloudFront, the rest straight to the load balancer: $960.89 a month, 12.8% less than before, computed.

Assumptions

• Illustrative configuration in Paris (eu-west-3), not a client case.
• Each month, 8,192 GB of static files of 256 KiB on average (33,554,432 requests) and 2,048 GB of dynamic pages and API answers of 32 KiB (67,108,864 requests): 100,663,296 requests and 10,240 GB in all, viewers in Europe. The dynamic requests are GET requests, so no data goes to the origin.
• Two cache behaviors: /static/* cached with the managed CachingOptimized policy, 95% of its requests cache hits (an assumption); every other path not cached (CachingDisabled). The load balancer processes the misses and the dynamic answers, 2,457.6 GB a month.
• Processed bytes are the load balancer's highest LCU dimension (an assumption: about 38 requests a second on average keep the other dimensions below it): 1 GB per LCU-hour, so 2,457.6 GB over 730 hours is 3.37 LCUs on average, rounded to the hundredth.
• An AWS WAF web ACL with 5 rules or managed rule groups protects the distribution (at most 1,500 WCUs, the default body inspection), and the domain's hosted zone is in Route 53 with an ALIAS record to the distribution. A flat-rate plan requires the web ACL and covers it, and covers the hosted zone attached to the plan.
• On the Business plan, the distribution stays within its monthly allowance of 125 million requests and 50 TB, and meets the plan's conditions.
• The account has no other data transfer out to the internet in Paris and no other CloudFront traffic.

Not counted

• The instances behind the load balancer, the same in every variant: the cache lowers their load, which has no list price.
• AWS WAF logs, Bot Control and the other paid AWS WAF features; Lambda@Edge.
• The CloudFront free tier and the 100 GB a month of data out that AWS does not charge across services.
• Data sent to the origin by POST and PUT requests (billed per GB from Europe's edge locations).

Sources

• Amazon CloudFront pay-as-you-go pricing
• CloudFront flat-rate pricing plans
• Amazon CloudFront FAQs
• Elastic Load Balancing pricing
• AWS WAF pricing
• Use managed cache policies
• What is Amazon CloudFront?

USD before tax, 730 h a month. AWS Price List, eu-west-3, Europe edge locations and global, offer files published September 11, 2026, September 14, 2026, September 16, 2026 and October 3, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.

Pattern 3 of 4 · Illustrative configuration

A global audience: Price Class All or Price Class 100

A media library in an S3 bucket in Paris is served worldwide through CloudFront, 100 TB a month: every edge location with Price Class All, the least expensive ones with Price Class 100.

Scroll the diagram sideways →

Billed at the United States rates instead of Europe's, the viewers outside the class bring Price Class 100 to $8,306.29, 12.3% less than Price Class All; Price Class 200 costs $9,037.58, 4.6% less, computed. The Premium plan at its 125 TB level, at $2,250.00, is one price wherever the viewers are, and needs no price class at all.

Before · Price Class All$9,470.05

With the levers · Price Class 100$7,902.98

• Network$9,470.05 → $7,902.98, too small to draw

Before · Price Class All: network $9,470.05, total $9,470.05 a month.

With the levers · Price Class 100: network $7,902.98, total $7,902.98 a month.

With the levers: $1,567.07 a month less (16.5% less), computed.

Levers

• Choose the price class by where the viewers are
• Put a distribution on a flat-rate plan when it fits

The bills line by line, the assumptions and the sources

A global audience: Price Class All or Price Class 100, before: Price Class All Illustrative

Every edge location serves its own viewers, at its group's rates.

Line	A month
Network	$9,470.05
CloudFront data out, Europe, first 10 TB10,240 GB × $0.085 /GB	$870.40
CloudFront data out, Europe, next 40 TB35,840 GB × $0.08 /GB	$2,867.20
CloudFront HTTPS requests, Europe47,185,920 requests × $0.012 /10K req	$56.62
CloudFront data out, United States, first 10 TB10,240 GB × $0.085 /GB	$870.40
CloudFront data out, United States, next 40 TB15,360 GB × $0.08 /GB	$1,228.80
CloudFront HTTPS requests, United States26,214,400 requests × $0.01 /10K req	$26.21
CloudFront data out, Japan, first 10 TB8,192 GB × $0.114 /GB	$933.89
CloudFront HTTPS requests, Japan8,388,608 requests × $0.012 /10K req	$10.07
CloudFront data out, Asia Pacific, first 10 TB8,192 GB × $0.12 /GB	$983.04
CloudFront HTTPS requests, Asia Pacific8,388,608 requests × $0.012 /10K req	$10.07
CloudFront data out, South America, first 10 TB6,144 GB × $0.11 /GB	$675.84
CloudFront HTTPS requests, South America6,291,456 requests × $0.022 /10K req	$13.84
CloudFront data out, Australia, first 10 TB4,096 GB × $0.114 /GB	$466.94
CloudFront HTTPS requests, Australia4,194,304 requests × $0.0125 /10K req	$5.24
CloudFront data out, India, first 10 TB4,096 GB × $0.109 /GB	$446.46
CloudFront HTTPS requests, India4,194,304 requests × $0.012 /10K req	$5.03
A month, computed	$9,470.05

A global audience: Price Class All or Price Class 100, with the levers: Price Class 100 Illustrative

Only the edge locations of North America and of Europe, Israel and Türkiye serve the distribution; the viewers elsewhere are billed at the Europe rates.

Line	A month
Network	$7,902.98
CloudFront data out, Europe, first 10 TB10,240 GB × $0.085 /GB	$870.40
CloudFront data out, Europe, next 40 TB40,960 GB × $0.08 /GB	$3,276.80
CloudFront data out, Europe, next 100 TB25,600 GB × $0.06 /GB	$1,536.00
CloudFront HTTPS requests, Europe78,643,200 requests × $0.012 /10K req	$94.37
CloudFront data out, United States, first 10 TB10,240 GB × $0.085 /GB	$870.40
CloudFront data out, United States, next 40 TB15,360 GB × $0.08 /GB	$1,228.80
CloudFront HTTPS requests, United States26,214,400 requests × $0.01 /10K req	$26.21
A month, computed	$7,902.98

Price Class 100, viewers outside billed at United States rates: $8,306.29 a month, 12.3% less than before, computed.

Price Class 200: $9,037.58 a month, 4.6% less than before, computed.

Premium flat-rate plan at the 125 TB level: $2,250.00 a month, 76.2% less than before, computed.

Assumptions

• Illustrative configuration in Paris (eu-west-3), not a client case.
• 102,400 GB (100 TB) a month of 1 MiB objects: 104,857,600 requests, one per object. Viewers: Europe 45%, United States 25%, Japan 8%, Asia Pacific 8%, South America 6%, Australia 4%, India 4% (an assumed mix).
• With Price Class All, each viewer is served by an edge location of its own geographic group, billed at that group's rates; each group's tiers count its own GB.
• With Price Class 100, the viewers outside North America and Europe (30% of the traffic) are served by edge locations in the class, and the bill prices them at the Europe rates: an assumption, since which edge location of the class serves them is AWS's routing. One alternative prices them at the United States rates instead.
• With Price Class 200, only South America and Australia (10%) move, priced at the Europe rates under the same assumption.
• On the Premium plan at its 125 TB level, the distribution stays within its monthly allowance of 1.25 billion requests and 125 TB, and meets the plan's conditions.

Not counted

• Latency, which AWS warns can rise for viewers outside the price class.
• The origin's side, the same in every variant: S3 storage and GET requests (data from S3 to CloudFront is not billed).
• The CloudFront free tier.

Sources

• Amazon CloudFront pay-as-you-go pricing
• Amazon CloudFront FAQs
• Distribution settings reference

USD before tax, 730 h a month. AWS Price List, Europe, United States, Japan, Asia Pacific, South America, Australia and India edge locations, and global, offer files published September 11, 2026 and October 3, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.

Pattern 4 of 4 · Illustrative configuration

Deploys that invalidate every changed file

A single-page application on S3 and CloudFront is deployed every working day, and its pipeline invalidates each file a deploy changes: one invalidation path per changed file, or versioned file names and one path per deploy.

Scroll the diagram sideways →

The 44,000 paths a month cost $215.00 beyond the account's first 1,000, computed; with versioned file names the same deploys stay within the free paths. A team that invalidates /* instead pays for one path per deploy but empties the caches every time, and the origin serves every file again.

Before · One invalidation path per changed file$326.04

With the levers · Versioned file names, one path per deploy$111.04

• Network$111.04 → $111.04, too small to draw
• Other$215.00 → —, too small to draw

Before · One invalidation path per changed file: network $111.04, other $215.00, total $326.04 a month.

With the levers · Versioned file names, one path per deploy: network $111.04, other $0.00, total $111.04 a month.

With the levers: $215.00 a month less (65.9% less), computed.

Levers

• Version file names instead of invalidating them

The bills line by line, the assumptions and the sources

Deploys that invalidate every changed file, before: One invalidation path per changed file Illustrative

The pipeline invalidates each changed path: 44,000 paths a month.

Line	A month
Network	$111.04
CloudFront data out, Europe, first 10 TB1,024 GB × $0.085 /GB	$87.04
CloudFront HTTPS requests, Europe20,000,000 requests × $0.012 /10K req	$24.00
Other	$215.00
Invalidation paths, the first 1,0001,000 paths × $0.00 /path	$0.00
Invalidation paths beyond 1,00043,000 paths × $0.005 /path	$215.00
A month, computed	$326.04

Deploys that invalidate every changed file, with the levers: Versioned file names, one path per deploy Illustrative

The build writes new file names, such as app.3f9c2b.js, and the pipeline invalidates /index.html only.

Line	A month
Network	$111.04
CloudFront data out, Europe, first 10 TB1,024 GB × $0.085 /GB	$87.04
CloudFront HTTPS requests, Europe20,000,000 requests × $0.012 /10K req	$24.00
Other
Invalidation paths, within the first 1,00022 paths × $0.00 /path	$0.00
A month, computed	$111.04

Assumptions

• Illustrative configuration in Paris (eu-west-3), not a client case.
• Viewers in Europe: 1,024 GB (1 TB) and 20,000,000 requests a month, the same in both variants.
• 22 deploys a month, one a working day, each changing 2,000 files: 44,000 invalidation paths a month when each changed file is invalidated, 22 when only /index.html is.
• The account has no other distribution, so the first 1,000 paths of the month, free for the whole account, are this pipeline's. No query-string variants and no URI rewrites multiply the paths.
• The new file names are fetched from the bucket once per cache, as invalidated files would be: the other lines do not change.

Not counted

• The CloudFront free tier.
• The S3 storage, PUT requests and origin fetches of the deploys, the same in both variants.
• A flat-rate plan, which includes invalidations.

Sources

• Invalidate files to remove content
• Pay for file invalidation
• What you need to know when invalidating paths
• Use file versioning to update or remove content with a CloudFront distribution
• Amazon CloudFront FAQs

USD before tax, 730 h a month. AWS Price List, Europe edge locations and global, offer file published October 3, 2026, fetched October 16, 2026. Illustrative configuration, not a client case.

How to reduce CloudFront costs

Each lever below comes from AWS documentation; their order is this article's. The Well-Architected Framework's data transfer practices point to CloudFront itself, "use edge locations or content delivery networks (CDN) to deliver content to end users" (COST08-BP03), and the levers then shape what it bills: see the bill first, trim the fees nothing needs, reshape what reaches the origin and the edge, route the traffic to the cheaper path, and only then commit, to a plan or a spend. The levers, in that order:

1. Lever 01,SeeSee the CloudFront bill by location, usage type and distributionAlways, and first
2. Lever 02,TrimVersion file names instead of invalidating themDeploys that invalidate many paths a month
3. Lever 03,TrimPay only for the logs and features you useReal-time logs, dedicated IP certificates
4. Lever 04,TrimCompress at the edgeText files: HTML, CSS, JavaScript, JSON
5. Lever 05,ReshapeRaise the cache hit ratio with a lean cache key and long TTLsAn origin that bills or struggles at peaks
6. Lever 06,ReshapeWeigh request fees against the cheaper GBMany small responses on pay-as-you-go
7. Lever 07,ReshapeRun light edge code in CloudFront FunctionsCode that runs on every request
8. Lever 08,RouteKeep the origin private, so every byte goes through CloudFrontAn origin that is also public
9. Lever 09,RouteChoose the price class by where the viewers areViewers in the expensive groups
10. Lever 10,RouteUse Origin Shield where the origin is costly to reachViewers in several regions, costly origins
11. Lever 11,CommitPut a distribution on a flat-rate plan when it fitsOne distribution within a plan's allowance
12. Lever 12,CommitCommit on spend for steady pay-as-you-go trafficSteady pay-as-you-go use, once the rest is done
13. Lever 13,ReviewReview on a cadenceEvery distribution

In short: See where CloudFront bills and what reaches the origin, trim the fees nothing needs, shape the cache key and the edge code, keep the origin private and the price class honest, and only then commit, to a flat-rate plan where a distribution fits one, or to a spend.

FAQ

How is CloudFront billed?

On pay-as-you-go, per GB of data out and per request, at the rates of the geographic group of the edge location that serves each viewer, plus fees for Origin Shield, invalidations past 1,000 paths, edge compute and logs; fetches from an AWS origin are free. A flat-rate plan replaces the data, the requests, the web ACL and an attached hosted zone with one monthly price per distribution (What a CloudFront bill is made of).

What are CloudFront's flat-rate pricing plans, and how do they compare with pay-as-you-go?

Monthly plans per distribution, from Free to Premium, each with an allowance of requests and data, AWS WAF and Route 53 included, and no overage charges. Where a distribution fits one, they cost far less than pay-as-you-go in this article's patterns; they require a web ACL, do not support features such as real-time logs, and bill Lambda@Edge on top (Flat-rate plans).

Which price class should I pick?

The one that matches where the viewers are. Price Class 100 keeps North America and Europe; 200 adds Japan, Asia Pacific, India, and the Middle East, South Africa, Kenya, Nigeria and Egypt; All adds South America, Australia and New Zealand. A smaller class saves only on viewers outside it, who may see more latency (Price classes).

Does CloudFront reduce S3 costs?

For large objects, yes: data from S3 to CloudFront is free and CloudFront's data out costs less per GB. For small objects on pay-as-you-go, the request fees can cost more than the GB saves: the break-even is about 168.0 KiB at a 95% hit ratio (CloudFront, or data straight out of the origin, and the S3 article's answer).

CloudFront Functions or Lambda@Edge?

CloudFront Functions for light work on every request, header changes, redirects, rewrites, token checks; Lambda@Edge for functions that run longer, call other services or read the body. Lambda@Edge costs more per request, bills its duration and has no free tier (CloudFront Functions and Lambda@Edge).