What Actually Drives Your CloudFront Bill in 2026

Run the arithmetic on a real invoice and the pattern is always the same: CloudFront pricing is not one price. A workload serving 200 TB/month split across North America, Europe, and India will land at three wildly different effective rates per TB, and the India slice can cost more than double the US slice for byte-identical content. Add request charges on a small-object API workload and the "data transfer" line stops being the story entirely. This article breaks down the four cost drivers that actually move an AWS CloudFront bill — regional transfer tiers, request volume, origin fetches, and the add-ons that bill on separate meters — plus a diagnostic procedure for finding which one owns your invoice.

The four meters behind CloudFront pricing

Everything on a CloudFront invoice reduces to four meters, and they scale independently. Understanding which one dominates your workload is the difference between an optimization that saves 30% and one that saves 2%.

• Data transfer out to internet (DTO): Billed per GB, priced by the geographic region of the edge location that served the byte, then tiered by monthly volume. This is the largest line for media, downloads, and game patching.
• Requests: Billed per 10,000 HTTP or HTTPS requests, also region-priced. Dominant for APIs, ad tech, telemetry, and any workload with a median object under roughly 20 KB.
• Origin fetches: Data transfer from your origin into CloudFront is free when the origin is an AWS service in a supported region. Non-AWS origins pay their own egress, and cross-region S3 reads add inter-region transfer.
• Add-ons on separate meters: Functions, Lambda@Edge, WAF, Shield Advanced, real-time logs, field-level encryption, KeyValueStore, and origin shield each carry their own unit price and none of them are included in your DTO commitment.

The free tier as of 2026 still covers 1 TB of data transfer out, 10 million HTTP/HTTPS requests, and 2 million CloudFront Function invocations per month, permanently, not just for new accounts. Useful for staging environments. Irrelevant at production scale.

Regional transfer tiers: where the multiplier hides

CloudFront's regional pricing bands are the single most misunderstood part of AWS CloudFront cost. Prices below reflect published on-demand rates for the first 10 TB/month tier as of 2026. Higher tiers step down; the regional ratio between bands stays roughly constant.

Volume tiering steps down from $0.085/GB to roughly $0.080 above 10 TB, $0.060 above 50 TB, $0.040 above 150 TB, $0.030 above 500 TB, and $0.025 above 1 PB in the US/Europe bands. Two things about that curve matter operationally. First, tiers reset monthly, so a spiky workload never reaches the cheap end. Second, tiers apply per-region-band independently, so 500 TB split evenly across eight bands never gets the 500 TB rate anywhere.

That is the arithmetic most CloudFront cost models get wrong. A globally distributed 400 TB/month workload frequently lands at a blended effective rate near $0.055–0.070/GB — $55 to $70 per TB — not the $0.030 headline number people quote from the pricing table.

How to cut regional CloudFront data transfer cost without hurting users

Price classes are the blunt instrument: PriceClass_100 restricts to the cheapest bands, PriceClass_200 excludes South America and Australia. Restricting a distribution does not block those users, it routes them to a more distant edge, which raises RTT and can reduce cache hit ratio on that segment. For static assets with long TTLs the latency penalty is often acceptable. For interactive APIs it is not.

Request volume: the meter that eats API workloads

At $0.0100 per 10,000 HTTPS requests in North America, one billion requests costs $1,000. That sounds trivial until you notice that a billion requests of 8 KB responses is only 8 TB of transfer — about $650 at first-tier pricing. On small-object workloads, requests are the majority of the bill.

The crossover point is worth memorizing. In the US band, request charges exceed transfer charges when average object size drops below roughly 12 KB. Below 5 KB, requests are 70%+ of the invoice. Three consequences follow:

• Response compression reduces DTO but does nothing to request count. Compressing 4 KB JSON to 900 bytes saves pennies; collapsing ten API calls into one GraphQL query saves dollars.
• HTTP/2 and HTTP/3 multiplexing do not reduce billed requests. CloudFront bills per HTTP request, not per connection.
• Cache hit ratio does not reduce request charges at all. Every request that reaches an edge is billed whether it hits or misses.

That last point is the one that surprises people. Improving CHR from 85% to 97% cuts origin load and origin egress, and it improves latency. It does not move the request line by a single cent.

Origin fetches, origin shield, and the cross-region trap

Data transfer from AWS origins (S3, EC2, ALB, Elemental) into CloudFront is billed at $0.00 per GB. That is real and it is the strongest structural argument for CloudFront when your origin already lives in AWS. It is also where the hidden costs sit.

Origin Shield adds a dedicated regional caching layer and bills as an additional request charge, roughly $0.0075–0.0090 per 10,000 requests depending on region, on top of normal request costs. It pays for itself when you have many edge locations pulling the same objects, high origin egress cost, or an origin that cannot absorb the miss fan-out. For an S3 origin in the same region with free egress, Origin Shield often costs more than it saves — you are paying request fees to protect against transfer fees that are zero.

The genuine trap is a non-AWS origin. Then every cache miss triggers billable egress from your own infrastructure or another cloud, at rates typically between $0.05 and $0.09/GB. A distribution at 92% CHR serving 100 TB pulls roughly 8 TB from origin. At $0.08/GB that is $640/month sitting in a line item nobody attributes to CDN spend.

The add-ons that bill separately in 2026

Invalidation deserves a note. A wildcard invalidation counts as one path. Enumerating 4,000 changed files on each of 30 daily deploys is 120,000 paths, about $595/month, for something a content-hash filename scheme makes unnecessary.

Failure modes: how CloudFront bills go wrong in production

The cost drivers above are the steady state. These are the patterns that produce the invoice that gets escalated.

Cache-key explosion from query strings

Forwarding all query strings to the cache key turns one object into thousands of variants. Analytics parameters, session tokens, and cache-busting suffixes appended by third-party scripts each create a distinct cache entry. CHR collapses, origin fetches multiply, and if the origin is off-AWS the egress bill doubles overnight. The fix is a cache policy with an explicit query-string allowlist, and an origin request policy that forwards the rest without including them in the key.

Range-request amplification on video

HLS and DASH players issue byte-range requests. Without range-request caching configured properly, a single 4 GB asset can generate hundreds of origin fetches for overlapping ranges. On a non-AWS origin this shows up as origin egress far exceeding delivered bytes — a ratio above 1.0 is the diagnostic signature.

Error responses billed at full request price

404s, 403s, and 503s are billable requests. A misconfigured client retrying a dead endpoint at 50 RPS generates 130 million billable requests per month, roughly $1,300, delivering zero bytes. Set a non-zero error caching minimum TTL and alert on 4xx/5xx rate as a cost metric, not just a reliability metric.

Traffic scraped rather than served

Automated crawlers pulling large media libraries produce genuine DTO at full price. The bytes are real, the requests are real, the value is zero. Signed URLs or token authentication is cheaper than the WAF Bot Control per-request surcharge for most media catalogs.

Blended cost per TB: the only number worth tracking

Stop comparing headline per-GB rates. Compute total monthly CloudFront invoice divided by delivered TB, including requests, add-ons, and origin egress. That blended figure is what you compare against alternatives.

For a globally distributed workload at 300–500 TB/month with moderate request density and standard security tooling, blended cost on CloudFront in 2026 typically lands between $55 and $85 per TB. Under 50 TB, it is frequently above $90 per TB.

Put that against volume-based providers. Bunny.net and KeyCDN price aggressively at low volume with regional variance; CDN77 and Gcore compete on committed enterprise contracts; Fastly wins on programmability and live streaming behavior. BlazingCDN's volume pricing starts at $100/month for 25 TB — $5 per TB, $0.004 per additional GB — and steps to $1,500 for 500 TB, $2,500 for 1,000 TB, and $4,000 for 2,000 TB, which works out to $2 per TB at the top tier. The rate does not change by destination region, which removes the India and South America multipliers from the model entirely.

BlazingCDN delivers the stability and fault tolerance enterprises expect from CloudFront, with 100% uptime, NVMe SSD edge storage, flexible per-property configuration, and fast scaling under demand spikes. For media platforms and software distributors moving hundreds of terabytes, the difference between $70/TB blended and $3/TB flat is the entire delivery budget. CloudFront still wins where free S3 origin egress, tight IAM integration, and Lambda@Edge programmability outweigh per-TB cost — that is a real trade-off, not a marketing one. Worth testing both against your actual traffic mix.

FAQ

Does improving cache hit ratio reduce my CloudFront pricing?

It reduces origin fetch costs and improves latency, but it does not reduce request charges — every request that reaches an edge is billed regardless of hit or miss. If your origin is an AWS service with free egress to CloudFront, raising CHR from 90% to 98% may save almost nothing on the invoice. If your origin is outside AWS, the same improvement can cut origin egress by 80%.

What is the actual crossover point where requests cost more than data transfer?

In the North America band as of 2026, at $0.085/GB and $0.0100 per 10,000 HTTPS requests, request charges exceed transfer charges when average object size falls below roughly 12 KB. Below 5 KB, requests dominate the invoice. Compute your own crossover from your median response size before optimizing the wrong meter.

Do CloudFront volume tiers apply globally or per region?

Per region band, independently, and they reset every month. A workload delivering 500 TB spread across eight regional bands never reaches the 500 TB rate in any of them. This is why blended cost per TB on globally distributed traffic is typically 60–100% higher than the headline tier rate suggests.

Is Origin Shield worth the extra request charge?

It depends entirely on origin egress cost. With a same-region S3 origin where CloudFront ingress is free, Origin Shield's per-request fee often exceeds any savings. With a non-AWS origin paying $0.05–0.09/GB egress, or an origin with limited capacity, the collapsed miss fan-out usually justifies it within the first month.

How do CloudFront private pricing agreements work?

AWS negotiates committed-volume contracts, typically starting around 10 TB/month sustained, that trade a monthly minimum spend and a term commitment for discounted per-GB rates. Discounts scale with volume and term length. Bring a twelve-month traffic profile broken down by region band, because the regional mix drives the discount structure more than total volume does.

Are 404 and 403 responses billed?

Yes, at the full HTTPS request rate for the serving region. A retry storm against a dead endpoint can generate thousands of dollars in request charges while delivering no bytes. Configure a non-zero minimum TTL for error responses and treat 4xx/5xx rate as a billing signal.

Run this diagnostic before your next invoice cycle

Pull last month's Cost and Usage Report filtered to CloudFront and break it into four buckets: DTO by region band, requests by region band, add-on meters, and origin egress from any non-AWS origin. Divide the total by delivered TB. That single blended number is your real CloudFront pricing, and most teams find it is 40–80% higher than the per-GB rate they had in their head.

Then compute your object-size crossover and check whether you have been optimizing transfer on a request-dominated workload. If your delivered-bytes-to-origin-bytes ratio is below 1.0, you have range-request amplification. If a single region band accounts for under 5% of traffic but over 15% of cost, price classes deserve a look.

What is your blended cost per TB, and which meter owns your invoice? That is the conversation worth having with your platform team this week.