Amazon CloudFront Cost Optimization in 2026: Price Classes, Origin Shield, and the Security Savings Bundle

Updated: August 17, 2026

Amazon CloudFront cost optimization in 2026 comes down to five levers: choosing the right price class, raising your cache hit ratio, using Origin Shield only where the math works, subscribing to the Security Savings Bundle when your baseline is predictable, and moving edge logic from Lambda@Edge to CloudFront Functions. Get those five right and most teams cut their CloudFront bill 40-70% without touching a single origin. This guide walks through every lever with real 2026 pricing, worked examples, and honest comparisons against Azure Front Door, Cloud CDN, and Fastly.

• Data transfer out (DTO) is the dominant line item. India, Australia, and South America cost 30-45% more per GB than US/Europe, so price classes are a direct discount if you can accept regional trade-offs.
• The Security Savings Bundle gives a 30% discount on CloudFront usage for a 12-month commit. Worth it only if your monthly minimum is stable and you'll also use AWS WAF.
• Origin Shield saves money when cache hit ratio at the edge is below ~85% or origins are far from viewers. It can increase cost when hit ratios are already high.
• Origin fetch from AWS-region S3, EC2, ALB, or Lambda in the same region is free, though cross-region and out-of-region origins still incur inter-region transfer.
• CloudFront Functions cost $0.10 per million requests vs $0.60 for Lambda@Edge. Migrate short header/URL rewrites and A/B routing to save 6x.
• For flat-rate egress at scale, Fastly and Bunny.net beat CloudFront's on-demand pricing, but AWS bundle discounts and free S3 origin fetch usually close the gap.

How CloudFront pricing actually works in 2026

CloudFront charges you for four things: data transfer out to viewers (DTO), HTTP/HTTPS requests, edge compute (Functions and Lambda@Edge), and a handful of add-ons (real-time logs, origin shield fetches, KeyValueStore reads, invalidations beyond 1,000/month, dedicated IPs for legacy SSL, and field-level encryption). The reason bills spike is almost always DTO, and the reason DTO spikes is almost always low cache hit ratio combined with unfavourable regional pricing.

Two pricing rules that catch most teams off guard:

1. Origin fetch is free from same-region AWS origins. If your S3 bucket, ALB, or EC2 fleet is in us-east-1 and the origin request hits an edge location that fetches from us-east-1, you pay $0.00 for the origin-side transfer. This has been true since December 2021 and it's the single biggest reason CloudFront in front of S3 is cheaper than serving S3 direct. Plus you avoid the S3 request-charge premium on hot objects.
2. DTO is billed by the region of the edge location that served the response, not the region of the viewer or the origin. If a Mumbai viewer is served from a Singapore edge (because Mumbai edges are throttled or you're on Price Class 200), you pay Singapore rates, not India rates. Price classes work by excluding expensive edges, forcing failover to cheaper ones.

The 2026 pricing sheet also introduced tiered volume discounts on requests, not just DTO. HTTPS request pricing drops from $0.0100 per 10K to $0.0080 per 10K once you exceed 200 million requests/month per account. For high-request/low-DTO workloads (APIs, thin JSON responses, tracking pixels) that matters more than most cost tools surface.

How much does CloudFront cost per GB?

CloudFront's per-GB DTO in 2026 varies from about $0.020 to $0.170 depending on region and volume tier. Below is the practical view most FinOps teams need. First-10TB rates are rounded to the cent, which is where 95% of accounts live:

Region	DTO (first 10 TB/mo)	HTTPS requests (per 10K)	vs cheapest region
United States, Canada	$0.085	$0.0100	baseline
Europe, Israel	$0.085	$0.0120	+0% DTO
South Africa, Kenya	$0.110	$0.0220	+29% DTO
South America	$0.110	$0.0220	+29% DTO
Japan	$0.114	$0.0120	+34% DTO
Australia, New Zealand	$0.114	$0.0125	+34% DTO
Singapore, South Korea, Taiwan, Hong Kong, Philippines	$0.120	$0.0090	+41% DTO
India	$0.109	$0.0170	+28% DTO
Middle East	$0.110	$0.0220	+29% DTO

Volume tiers cut sharply above 40 TB/month. A workload pushing 500 TB/month out of North America pays a blended rate closer to $0.045/GB. Anything above 5 PB/month gets a custom private pricing agreement, so call your account team and don't accept public rates. For a working model of how blended pricing changes with volume, AWS publishes the tier table on the CloudFront pricing page.

What surprises people: request charges become dominant for API-style workloads. A public API returning 2 KB JSON at 10 billion requests/month pays roughly $8,000 in DTO but $10,000 in HTTPS request charges. Rewriting to return 512 bytes doesn't help. You still pay per request. The lever there is edge caching (see below).

Price classes: when to use 100, 200, or All

Price classes are the single easiest CloudFront cost win: a two-click change in the console with no code impact. The trade-off is which edge regions serve your traffic:

• Price Class 100. US, Canada, Europe, Israel edges only. All other viewers get routed to those regions (typically the closest European or US edge). Blended DTO cost ~$0.085/GB regardless of viewer location.
• Price Class 200. Adds most of Asia (except Japan/Korea/Australia) and cheaper Middle East/Africa edges. Blended cost ~$0.090/GB.
• Price Class All. Everything, including expensive tier edges (India, Japan, Korea, Australia). Blended cost ~$0.095-0.110/GB depending on traffic mix.

The right choice depends on where your paying users are. Ecommerce and SaaS with 90%+ US/EU viewers should default to Price Class 100. A Mumbai viewer served from a Frankfurt edge adds 180ms of RTT, which for cart pages is noticeable but rarely a conversion killer. Streaming, gaming, and real-time apps need Price Class All because 180ms breaks the product. Static asset domains (fonts, CSS, JS) can almost always drop to Price Class 100 because HTTP/2 pipelining hides the extra latency.

Honestly, I've seen teams switch to Price Class 100 during a Friday cost review and see the savings land the following Monday morning in Cost Explorer. It's that fast. Run this cost model before switching though: pull 30 days of DTO grouped by edge location from your CloudFront standard logs or CUR (Cost and Usage Report), classify by region, and multiply excluded-region traffic by the fallback region rate. Real savings for a US-SaaS workload switching from All to 100 usually land at 8-15%, not 30%.

What is Origin Shield and when does it save money?

Origin Shield is an extra caching layer that sits between CloudFront edge locations and your origin. Instead of every edge fetching from origin on a cache miss, edges fetch from Origin Shield first, and only Origin Shield fetches from origin. The purpose is to raise the effective cache hit ratio for your origin: a hot object requested by 200 edges is fetched once from origin instead of 200 times.

Origin Shield costs $0.0075 per 10,000 requests in most regions ($0.020 in expensive tiers) plus DTO between the shield and the edges. It's included in most Security Savings Bundle plans.

Origin Shield saves money when:

• Your origin fetch costs are non-trivial. Think S3 request charges on hot objects (over $500/month in S3 GET fees is a good threshold), EC2 CPU under load, or a paid origin like a data provider.
• Your edge hit ratio is below 85%. High-miss workloads (long-tail static, personalized content, dynamic APIs with brief TTLs) benefit most.
• Origins are far from most edges. A Frankfurt origin serving a global audience will amplify origin RTT, and Origin Shield collapses that to one round-trip.

Origin Shield costs you money when your edge hit ratio is already 90%+ (you're just adding a request-charge tax to the 10% of requests that miss) or when origin fetches are already free (same-region AWS origin, low request volume). I've reviewed dozens of accounts where Origin Shield was enabled "because it's a best practice" and it was adding $2,000-$5,000/month of pure overhead. My last CloudFront audit for a media startup killed shield on three distributions and saved $3,400 the first month.

The CloudFront Security Savings Bundle explained

The Security Savings Bundle is a monthly-commit discount program: you commit to a fixed monthly spend on CloudFront for 12 months, and AWS gives you a 30% discount on the CloudFront portion plus bundled AWS WAF and AWS Shield Advanced access (Shield Advanced retails at $3,000/month standalone, so this is a real value if you'd otherwise pay for it).

Mechanics: your committed monthly spend becomes a floor. If your usage in a given month is below the commit, you still pay the commit, like a Reserved Instance. If usage exceeds the commit, the excess is billed at on-demand rates minus the 30% discount. Unused commitment does not roll over.

When it pays off:

• Predictable monthly baseline. Commit at ~85-90% of your P50 usage, not P90. Overcommit is a straight loss.
• You already use or plan to use AWS WAF. The bundled WAF web ACL and rule charges alone can offset the commit cost for high-request sites.
• You're not planning to migrate to a different CDN within 12 months (obviously).

When to skip:

• Traffic is spiky or seasonal (media launches, retail Q4-heavy). Commit to floor, pay on-demand for peaks. But do the math on whether Compute Savings Plans-style flexibility beats a straight 30%.
• You're in a startup burn phase where CloudFront usage is doubling every 90 days. You'll blow through the commit and get no benefit.
• Total CloudFront spend is under ~$1,500/month. The operational overhead of managing the commit exceeds savings, and 30% of a small number is still a small number.

The bundle is separate from AWS Compute Savings Plans and doesn't count toward that coverage. If you're already thinking about broader commitment strategy across your account, see our guide on AWS Compute Savings Plans coverage and utilization for how to model that separately.

How to reduce CloudFront costs: 8 levers that work

Ranked by effort-to-savings ratio, from highest-leverage to lowest:

1. Raise cache hit ratio (biggest lever, often free)

Every 1% improvement in cache hit ratio removes 1% of origin fetch DTO and origin infrastructure cost. Get your cache hit ratio in CloudFront console (Reports → Cache statistics) or query CloudWatch's CacheHitRate metric. Anything below 85% is money on the floor.

Common cache-hit killers:

• Cache-busting query strings not stripped in cache key. Configure the origin request policy to ignore analytics params (utm_*, fbclid, gclid).
• Vary: Cookie or Vary: Authorization from origin. Every unique cookie value creates a cache entry. For personalized sites this is intentional, for public pages it's usually a misconfiguration.
• Short TTLs on static assets. Immutable hashed filenames (app.a3f9c2.js) can have Cache-Control: public, max-age=31536000, immutable. Setting this alone can move CHR from 60% to 95%.

2. Switch price class (5-minute change, 8-15% savings for US/EU-heavy workloads)

Covered above. Model in a Jupyter notebook first, but the console change itself is instant.

3. Migrate short edge logic from Lambda@Edge to CloudFront Functions

See the dedicated section below.

4. Compress at the edge and at the origin

CloudFront auto-compresses text responses (gzip and Brotli) when the origin returns uncompressed content up to 10 MB. Enable "Compress objects automatically" on each behavior. This directly reduces DTO. A 400 KB JSON that compresses to 60 KB is an 85% saving on that response. For pre-compressed assets, serve .br variants at origin with proper Content-Encoding.

5. Use S3 Transfer Acceleration selectively (usually skip)

S3 TA is a separate product that uses CloudFront edges for uploads. It adds $0.04/GB. For most static-serving workloads it's the wrong tool. You want CloudFront in front of S3, not TA. Only enable TA for upload-heavy applications where users are far from the bucket region.

6. Purge invalidations from your deploy pipeline

You get 1,000 free invalidation paths/month, then $0.005 each. Teams that invalidate /* on every deploy burn hundreds of dollars for nothing. Instead deploy with hashed filenames so new versions are cache-cold naturally, and reserve invalidations for hotfixes.

7. Use Response Headers Policies instead of edge functions for header manipulation

Adding CORS, HSTS, or CSP headers via Lambda@Edge costs $0.60 per million invocations. Response Headers Policies do the same thing for free (they're a config primitive, not compute). Migrate wherever the header value doesn't need per-request logic.

8. Delete unused distributions and stale logs

Every distribution has a minimum charge if there's any traffic to it. Zombie distributions from old marketing campaigns, staging environments left behind, or acquired-company setups quietly drip cost. Our related guide on finding zombie cloud resources with CLI scripts has a CloudFront section that lists distributions with less than 1 GB/month of traffic. Prime candidates for deletion.

Terraform snippet for a properly cost-optimized distribution baseline:

resource "aws_cloudfront_distribution" "web" {
  enabled             = true
  is_ipv6_enabled     = true
  http_version        = "http3"    # HTTP/3 default since 2024
  price_class         = "PriceClass_100"   # US/CA/EU only
  default_root_object = "index.html"

  origin {
    domain_name              = aws_s3_bucket.web.bucket_regional_domain_name
    origin_id                = "s3-web"
    origin_access_control_id = aws_cloudfront_origin_access_control.web.id

    # Origin Shield: enable only if CHR < 85% OR origin cost is material
    origin_shield {
      enabled              = false
      origin_shield_region = "us-east-1"
    }
  }

  default_cache_behavior {
    target_origin_id       = "s3-web"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true    # DTO saver

    # Managed policy that strips utm_* and other cache busters
    cache_policy_id            = "658327ea-f89d-4fab-a63d-7e88639e58f6"   # CachingOptimized
    response_headers_policy_id = aws_cloudfront_response_headers_policy.security.id
  }

  # No dedicated-IP SSL. SNI only, free
  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate.web.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  restrictions {
    geo_restriction { restriction_type = "none" }
  }
}

CloudFront Functions vs Lambda@Edge cost

These two products look similar and get confused constantly. Pricing tells you which to use:

Dimension	CloudFront Functions	Lambda@Edge
Price per million invocations	$0.10	$0.60 (plus duration and memory)
Runtime	JavaScript (cloudfront-js-2.0)	Node.js, Python
Execution time limit	<1 ms (submillisecond)	Up to 5 seconds (viewer), 30 seconds (origin)
Memory limit	2 MB	Up to 10,240 MB
Network access	No	Yes
Event types	Viewer request, viewer response	Viewer + origin request/response
Good for	Header/URL rewrites, A/B routing, token validation	Server-side rendering, dynamic origin selection, personalized responses

The 6x price gap adds up fast. A viewer-request Lambda@Edge that adds a security header on 500 million requests/month costs $300 in invocations plus ~$200 in duration charges. The equivalent CloudFront Function costs $50 flat. For a header manipulation that doesn't need network access, this is free money.

Migration is usually 30 minutes: rewrite the handler in JS, deploy via console or Terraform's aws_cloudfront_function, swap the association on the behavior, monitor for 24 hours, delete the Lambda@Edge function once you're confident. I hit this exact migration on a project last quarter and it clipped $480/month off the bill for what amounted to a one-afternoon change. AWS's CloudFront Functions developer guide has migration examples for the common cases.

CloudFront vs Azure Front Door vs Cloud CDN vs Fastly

Rachel's take after benchmarking these across three real workloads (a static SaaS marketing site at 10 TB/month, a media startup at 500 TB/month, and a global public API at 3 billion requests/month):

Dimension	CloudFront	Azure Front Door Std	Cloud CDN	Fastly
DTO US/EU (first 10 TB)	$0.085/GB	$0.083/GB	$0.080/GB	$0.12/GB (or negotiated flat)
DTO Asia (first 10 TB)	$0.114-0.120/GB	$0.130/GB	$0.090-0.150/GB	$0.19/GB
Requests (per 10K, HTTPS US)	$0.0100	$0.0090	$0.0075	Bundled in DTO
Commitment discount	Security Savings Bundle: 30%	Reservations: up to 40%	CUDs: up to 20%	Committed use: 30-50%
Free origin fetch	Same-region AWS: yes	Same-region Azure: yes	Same-region GCP: yes	Any origin: no
Edge compute cost (per 1M)	$0.10 (Functions)	Bundled in Rules Engine	$0.20 (Edge Fns)	$0.50 (Compute@Edge)
Best fit workload	AWS-anchored, mixed traffic	Azure-anchored, enterprise-heavy	GCP-anchored, GKE workloads	Media, latency-critical, custom logic

The honest read: for pure per-GB egress at scale, Cloud CDN comes out cheapest in North America, and Fastly's negotiated flat-rate deals crush everyone above 1 PB/month if you can commit. But if your origin lives in AWS, the free same-region origin fetch and CloudFront's bundle discounts almost always net out cheaper than a cross-cloud CDN paying inter-cloud egress on the origin side. Azure Front Door Standard is the only real choice if your origin is Azure. The reverse cross-cloud math is punishing.

Cross-cloud egress is where most of these comparisons get lost, so if you're trying to reason about that layer, see our deep dive on cloud networking costs and data transfer. For teams running multi-cloud workloads, our managed PostgreSQL cost comparison uses the same side-by-side methodology on the database side. The CDN math follows the same logic: origin locality dominates.

When CloudFront is not the cheapest option

CloudFront wins by default for AWS-anchored workloads, but there are three scenarios where a different CDN or even no CDN wins:

1. Very high-egress workloads with predictable patterns. Above ~500 TB/month, Fastly, Bunny.net, and Cloudflare Enterprise offer flat-rate pricing that beats CloudFront's tiered rates. Bunny.net's public rate of $0.005/GB is roughly 10x cheaper than CloudFront's first-tier rate, but you lose free origin fetch, integrated AWS WAF, and IAM-native access controls.
2. Small internal apps under 100 GB/month. The complexity of CloudFront (behaviors, cache policies, invalidations, cert management) isn't worth it. Serve directly from S3 with an ALB or use a simpler edge like Cloudflare's free tier.
3. Hot media at global scale where cache hit ratio is 99%+. Fastly and specialized media CDNs (Akamai, Cloudflare Stream) have per-title analytics and origin-shield-by-default that outperform CloudFront on the last-mile experience, and their negotiated pricing at PB scale is competitive.

For most SaaS, ecommerce, and API workloads sitting inside AWS, CloudFront's cost is dominated by the same-region-origin-fetch discount and stays cheapest even before applying the Security Savings Bundle. The math changes only when you leave the AWS orbit.

Frequently Asked Questions

Does CloudFront charge for cache misses?

Yes and no. You pay the request charge for every request whether it hits or misses. On a miss, you also pay for the origin fetch data transfer, but that fetch is free from a same-region AWS S3, EC2, ALB, or Lambda origin. Cache misses to non-AWS origins or cross-region AWS origins are billed at inter-region transfer rates.

Is CloudFront cheaper than serving from S3 directly?

Almost always yes, for two reasons. First, S3 direct egress to the internet costs $0.09/GB vs CloudFront's $0.085/GB (blended), and CloudFront applies volume tiers that S3 doesn't. Second, S3 charges per GET request ($0.0004 per 1,000) on every request; CloudFront's cache absorbs 85-99% of them so S3 only sees origin fetches, which are free when in-region.

How do I see CloudFront costs broken down by distribution?

Enable per-distribution cost allocation tags on each distribution, then filter Cost Explorer or your CUR by tag. AWS does not break out CloudFront cost by distribution by default. The service-level line item aggregates all distributions in an account. If you inherited untagged distributions, backfill tags via the AWS CLI and wait 24 hours for Cost Explorer to reflect them.

Should I always enable Origin Shield?

No, this is a persistent myth. Origin Shield adds request charges and only pays off when your edge cache hit ratio is below ~85% or your origin fetches have material cost (S3 requests on hot objects, EC2 CPU load, paid origins). If your edge hit ratio is already 95% and origin is same-region S3, Origin Shield adds cost without benefit.

What is the difference between Price Class 100 and Price Class All?

Price Class 100 restricts your distribution to edge locations in the US, Canada, Europe, and Israel, the cheapest tier. Price Class All uses every edge location globally, including expensive-tier regions like India, Japan, and Australia. Switching from All to 100 for a US/EU-heavy audience typically saves 8-15% on DTO with minimal latency impact for non-real-time workloads.

Is the CloudFront Security Savings Bundle worth it?

It's worth it if three conditions hold: your monthly CloudFront spend has a predictable baseline of $1,500+ that you can commit to at 85-90% of P50, you already use or plan to use AWS WAF (the bundled WAF partially offsets the commit), and you're not planning to migrate CDNs within 12 months. Otherwise the 30% discount can be a net loss on unused commitment.