AWS’s metered CDN against Microsoft’s base-fee front door — how the two billing shapes decide the winner.
Winner depends on your workload.
Winner depends on: which cloud hosts your workloads, whether you need an L7 routing-and-WAF front end or a delivery-first CDN, and how your traffic volume sits relative to Front Door’s fixed base fees.
Side by side
| CloudFront | Azure Front Door | |
|---|---|---|
| Billing shape | Pure metering (or flat-rate plans); no base fee | Base fee ($35 / $330 per profile) + requests + egress |
| Egress (NA/EU start) | $0.085/GB; 1 TB/month free | $0.0825/GB; no free tier |
| Requests | $0.0075–$0.0100 per 10k | $0.009 (Std) / $0.015 (Prem) per 10k |
| Miss path | Free from AWS origins | $0.02/GB edge-to-origin; Azure origin-to-edge free |
| WAF | AWS WAF separate (bundled in flat-rate plans) | Custom rules both tiers; managed rules + bot protection on Premium |
| Private origins | VPC origins | Private Link (Premium) |
Same aisle, different products
Both sit at the front of a hyperscaler stack, but they are shaped differently. CloudFront is a CDN first: distributions, cache behaviors, price classes, and edge compute, with security composed from AWS WAF and Shield alongside. Front Door is an application front end first: anycast entry, path routing, origin failover and WAF folded into one profile, with caching as one feature among several. The buying mistake is usually category error — comparing them as interchangeable CDNs when one of them is really a routing product that caches.
The billing shapes, worked
CloudFront meters everything and starts free: 1 TB and 10 million requests a month at no charge, then $0.085/GB from NA/EU edges tiering down, with free origin fetch from AWS services. Front Door starts with a fixed fee — $35/month for Standard, $330/month for Premium — then meters requests ($0.009 or $0.015 per 10,000 in NA/EU) and egress from $0.0825/GB, and bills the miss path at $0.02/GB edge-to-origin.
Worked example, small workload: 500 GB and 20 million requests a month. CloudFront: $0 — inside the free tier. Front Door Standard: $35 base + ~$41 egress + $18 requests ≈ $94. Worked example, mid workload: 30 TB, 300 million requests, 90% hit ratio, NA/EU. CloudFront: roughly $2,450 egress + $300 requests ≈ $2,750 (with AWS origins adding nothing). Front Door Standard: $35 + ~$2,400 egress + $270 requests + $60 miss-path ≈ $2,765. The meters converge at scale; the fixed fee only dominates at the small end. Figures checked against provider pricing pages, July 2026.
What each does that the other doesn’t
CloudFront brings programmability Front Door lacks: two tiers of edge compute — dissected in CloudFront Functions vs Lambda@Edge — plus signed URLs and cookies, Origin Shield, and field-level encryption. Front Door brings an integrated L7 story CloudFront composes from parts: one profile carrying routing rules, health-probed origin failover, WAF policy and — on Premium — Private Link, so origins need no public endpoint. On AWS, the equivalent design typically stitches CloudFront to ALB, WAF and VPC origins; it works, and it is more pieces.
The ecosystem tax, both directions
Reliability posture is also worth a sentence, because it differs by construction. CloudFront is one product among many that AWS runs at arm’s length from your compute — a regional AWS incident rarely takes CloudFront with it. Front Door is deliberately fused into the Azure control plane, which buys integration and occasionally couples failure: profiles, WAF policy and origin health all live in one platform’s blast radius. Multi-region architectures on either cloud should read their provider’s post-incident reviews with that structural difference in mind.
Cross-cloud use is where both products stop making sense. Front Door in front of AWS origins pays AWS egress out and loses the free Azure origin path; CloudFront in front of Azure origins does the same in reverse. Each product’s economics are a loyalty program for its own cloud — which is the honest reason this comparison is usually settled by your architecture diagram rather than by either pricing page, the same conclusion we reached in Google Cloud CDN vs Azure Front Door.
How to decide
Match the product to the estate. Azure-native application with routing, failover and WAF needs: Front Door — Standard unless bot protection or Private Link forces Premium. AWS-native delivery workload: CloudFront, and the free tier plus flat-rate plans make the small end effectively free. Genuinely multi-cloud, or delivery-heavy beyond ~100 TB/month: benchmark both against specialist networks before renewing either — the hyperscaler edges are excellent defaults and mediocre standalone CDNs, by design.
Weighing a hyperscaler front end against a specialist network? The assessment runs your traffic file through both billing shapes.