AWS CloudFront Pricing in 2026: Cost Model Walkthrough

A mid-size streaming platform we spoke with in Q1 2026 discovered that 38% of their monthly AWS CloudFront pricing line items came not from data transfer but from HTTPS request charges and origin-shield fetches they had never explicitly budgeted for. Their total CDN spend was $14,200/month on roughly 50 TB of egress. When they modeled the same workload against volume-committed alternatives, the number dropped below $5,000. That gap is not unusual. AWS CloudFront pricing rewards you for understanding its components deeply and punishes you when you treat it as a flat-rate pipe. This article gives you the full 2026 rate card, a realistic cost-model walkthrough for three common workload profiles, a section on failure modes that silently inflate bills, and a decision framework for when CloudFront still makes sense versus when it does not.

AWS CloudFront Pricing Components in 2026

CloudFront bills across four axes. Miss any one and your estimate will be wrong.

Data Transfer Out (DTO) to the Internet

As of May 2026, the standard DTO rates from US and Europe edge locations remain unchanged from late 2025. Inbound transfer is free. Outbound is tiered:

South America, India, and Asia-Pacific regions carry premiums of 30–120% above these rates. A workload serving primarily LATAM traffic at 20 TB/month will cost roughly $0.110/GB from São Paulo edges, not $0.080. Your CloudFront pricing calculator output is only accurate if you weight by geographic distribution of your users, not just total volume.

CloudFront Request Pricing

Every HTTP or HTTPS request is metered separately from bandwidth. As of 2026, US/EU pricing:

This matters enormously for workloads with small average object sizes. A site serving 500 million HTTPS requests per month for tiny API responses or tracking pixels will pay $500 in request charges alone, independent of bandwidth. If those responses average 2 KB each, total DTO is under 1 TB ($85), but requests nearly equal the transfer cost. For many microservice or API-gateway patterns, CloudFront request pricing dominates the bill.

Origin Shield and Origin Fetches

Origin Shield, which collapses cache fills to a single regional fetch, costs $0.0090 per 10,000 requests (as of 2026). It reduces origin load but adds a per-request line item. The math works in your favor when your origin is expensive to hit (compute-heavy, cross-region, or rate-limited). It works against you when cache-hit ratios already exceed 95%.

Invalidation and Real-Time Logs

The first 1,000 invalidation paths per month remain free. Beyond that, $0.005 per path. Wildcard invalidations count as one path, but overusing them defeats granular cache control. Real-time logs shipped to Kinesis add $0.01 per million log lines. At 2 billion requests/month, that is $20, but it stacks onto everything else.

Cost-Model Walkthrough: Three Workload Profiles

This section is what most CloudFront pricing guides skip. Raw rate cards mean nothing without workload context. Below are three realistic 2026 scenarios modeled against published rates for the US/EU price class.

Profile A: Content-Heavy Media Site (100 TB/month, 800M HTTPS requests)

DTO cost: (10 TB x $0.085) + (40 TB x $0.080) + (50 TB x $0.060) = $850 + $3,200 + $3,000 = $7,050. Request cost: 800M / 10,000 x $0.01 = $800. Total before invalidation, Origin Shield, or Lambda@Edge: $7,850/month.

Profile B: API Gateway / Small Payloads (5 TB/month, 2B HTTPS requests)

DTO cost: 5 TB x $0.085 = $425. Request cost: 2B / 10,000 x $0.01 = $2,000. Requests are 4.7x the bandwidth cost. Total: $2,425/month. This is where CloudFront pricing becomes unintuitive. The bill is request-dominated.

Profile C: Software Distribution (500 TB/month, 50M HTTPS requests)

DTO cost: (10 x $0.085) + (40 x $0.080) + (100 x $0.060) + (350 x $0.040) = $850 + $3,200 + $6,000 + $14,000 = $24,050. Request cost: 50M / 10,000 x $0.01 = $50. Total: $24,100/month. At this volume, DTO dominates entirely, and you should be negotiating a private pricing agreement or evaluating alternatives.

Failure Modes That Silently Inflate Your CloudFront Bill

These are the patterns that cause the billing surprises nobody writes about in introductory pricing guides.

Cache-busting query strings

If your application appends unique query parameters (session tokens, analytics IDs) to cacheable assets, every request becomes a cache miss. Origin fetches spike, DTO doubles because you pay for origin-to-edge transfer within CloudFront, and your effective cache-hit ratio craters. Audit your cache key policy quarterly.

Geo-mismatch between origin and users

An S3 origin in us-east-1 serving primarily Southeast Asian users means every cache miss traverses a costly cross-region path. Origin Shield in an intermediate region helps, but the real fix is multi-origin with regional buckets or an origin closer to your audience gravity.

Invalidation storms during deploys

Teams that issue wildcard invalidations on every deploy can blow through the 1,000 free paths and generate thousands of paths per month. Versioned asset URLs (fingerprinted filenames) eliminate the need for invalidation entirely and improve cache-hit ratio.

Lambda@Edge cold-start cascades

Lambda@Edge charges $0.60 per million invocations plus $0.00005001 per 128 MB-second of compute (as of 2026). On high-request workloads, a poorly scoped viewer-request trigger can add hundreds of dollars monthly. CloudFront Functions at $0.10 per million invocations are 6x cheaper for lightweight header manipulation.

Is Data Transfer from S3 to CloudFront Free?

Yes, as of 2026, data transfer from S3 to CloudFront within the same AWS region incurs no charge. This is one of the genuine cost advantages of staying within the AWS ecosystem. However, the moment that byte leaves a CloudFront edge to reach a user, standard DTO rates apply. The free internal transfer only matters to the extent that your cache-hit ratio is high enough to minimize origin fetches.

When CloudFront Still Wins and When It Does Not

CloudFront pricing makes sense when your architecture is deeply coupled to AWS services (S3, ALB, API Gateway, MediaPackage) and you value the zero-cost internal transfer path plus tight IAM integration. For workloads under 10 TB/month with moderate request volumes, the bill is manageable and the operational overhead of a separate CDN vendor may not be justified.

The equation shifts at scale. At 100 TB/month and above, the blended CloudFront cost per GB frequently lands between $0.06 and $0.08. Volume-committed CDN providers routinely deliver the same traffic at $0.003–$0.004/GB. For organizations running 500 TB or more, the delta can exceed $15,000/month. BlazingCDN, for instance, prices 100 TB at $350/month (blended $0.0035/GB) and scales down to $0.002/GB at 2 PB, with 100% uptime commitments and fast scaling under traffic spikes. Enterprises like Sony use it alongside hyperscaler CDNs. For bandwidth-heavy workloads where AWS-native integration is not the primary constraint, the cost advantage is substantial enough to justify a multi-CDN architecture.

FAQ

How much does CloudFront data transfer cost in 2026?

For US and Europe edges, CloudFront charges $0.085/GB for the first 10 TB/month, stepping down to $0.040/GB between 150–500 TB. South America and Asia-Pacific regions are significantly more expensive, with rates reaching $0.110–$0.140/GB in some price classes.

How do I calculate CloudFront request charges?

Multiply your monthly request count by $0.0075 per 10,000 (HTTP) or $0.0100 per 10,000 (HTTPS) for US/EU. For accuracy, segment by region, because request pricing varies. API-heavy workloads with small payloads often find that requests, not bandwidth, are the largest cost component.

Why is CloudFront data transfer out so expensive compared to other CDNs?

CloudFront bundles AWS-native integration (free S3 origin transfer, IAM, Shield Standard) into its pricing. That integration tax is implicit in the per-GB rate. Standalone CDN providers that do not subsidize a broader cloud platform can offer egress at $0.002–$0.005/GB because their cost basis is pure transit and caching infrastructure.

Can I use CloudFront's free tier for production workloads?

The always-free tier covers 1 TB of DTO and 10 million HTTP/HTTPS requests per month. That is sufficient for low-traffic staging environments or personal projects. Any production site with meaningful traffic will exceed it within the first week of the month.

Does Origin Shield save money or add cost?

Both. Origin Shield adds $0.009 per 10,000 incremental requests, but it reduces origin fetches by collapsing cache fills. If your origin is compute-heavy or cross-region, the reduction in origin load and DTO from redundant fetches usually offsets the surcharge. If your cache-hit ratio is already above 95%, the savings are marginal.

How does CloudFront pricing compare to a multi-CDN strategy at 500 TB?

At 500 TB/month, CloudFront's blended DTO rate (before any private pricing) is approximately $0.048/GB, totaling around $24,000. A volume-committed provider at $0.003/GB delivers the same traffic for $1,500. Even splitting 50/50 between CloudFront and a lower-cost CDN cuts your bill by roughly 40%.

Next Step: Audit Your Actual Per-GB Cost

Pull your last three months of CloudFront billing from AWS Cost Explorer. Divide total CloudFront charges (DTO + requests + invalidation + Lambda@Edge + Origin Shield + real-time logs) by total GB delivered. That single number, your true blended per-GB cost, is the only metric that matters for comparison shopping. If it exceeds $0.05/GB at volumes above 50 TB, you are overpaying relative to 2026 market rates. Run the same calculation against two alternative CDN quotes this week and see where the delta lands.