CloudFront.The AWS-native choice.
Amazon’s CDN since 2008: 750+ points of presence, another 1,140+ embedded inside ISP networks, free data transfer from AWS origins, and billing that arrives on the AWS invoice you already pay. Inside an AWS estate it’s the path of least resistance, the honest question is what that convenience costs at your volume, per region, per request.
Amazon CloudFrontCloudFront in seven bars.
Our advisory read, scored against the 25+ provider field we benchmark. Blue is where CloudFront leads; gray is where the trade-offs live.
Scores are CDN World’s advisory judgment, not a lab measurement.
The default that ships with the cloud.
Launched in 2008 as AWS’s CDN, CloudFront is less a product decision than a gravitational one: if your origins are S3, EC2 or an ALB, it’s already integrated, already on your invoice, and fetching from those origins for free. The network is genuinely large, 750+ PoPs plus an embedded tier inside ISP networks, and the economics are genuinely intricate.
Edge PoPs at the front, 15 regional edge caches behind them, and 1,140+ embedded PoPs placed inside ISP networks across 300+ cities, an architecture built for cache hit ratio at Amazon scale.
Data transfer from AWS origins into CloudFront costs nothing, and the always-free tier carries 1 TB out per month. For AWS-native estates the delivery line starts cheap.
AWS Shield Standard DDoS protection is included, WAF attaches at the edge, and certificates come free via ACM, the pieces are all first-party.
CloudFront Functions for lightweight request logic at every PoP, Lambda@Edge for heavier work at regional caches, powerful, with ergonomics that are unmistakably AWS.
The platform, by line.
CloudFront and the first-party AWS services that attach to it at the edge.
Standard delivery from the global PoP estate, configured per distribution.
Core platformHLS/DASH delivery, with AWS Elemental services upstream for packaging and origination.
Core platformAn additional caching layer that concentrates origin fetches per region.
Add-onLog delivery to Kinesis Data Streams for near-live analysis.
Add-onNetwork-layer mitigation included with every distribution; Shield Advanced adds response teams and cost protection.
Core platformManaged and custom rules attached at the CloudFront edge.
Add-onA managed rule group within AWS WAF.
Add-onToken access controls and per-field payload encryption.
Core platformSub-millisecond JavaScript at every PoP for headers, rewrites and auth checks.
Add-onNode.js and Python at regional caches for heavier request-path work.
Add-onS3, EC2, ALB, API Gateway and MediaPackage as first-class origins, the integration is the product.
Core platformWhere the network runs deep.
Qualitative depth by region, our advisory read. The embedded-PoP tier concentrates in North America, Europe and Asia; mainland China is a separate AWS partition, not part of the global network.
Depth is relative to the field we benchmark, not a PoP count; regional presence changes frequently, confirm current coverage with the provider for your specific markets.
How CloudFront is bought.
Pay-as-you-go on the AWS bill, priced by geography and metered by request, tidy at small scale, intricate at large.
No contract to start: enable a distribution and pay as you go, with the always-free 1 TB monthly allowance and free fetch from AWS origins.
Every regional rate and request fee is public, transparency the enterprise networks don’t offer, if you can hold seven regional price sheets in your head.
The same gigabyte costs materially more in India, South America or South Africa than in North America or Europe; price classes can exclude expensive regions, trading latency for cost.
HTTPS requests bill per 10,000, so small-object, high-request profiles pay disproportionately, the classic CloudFront bill surprise.
The Security Savings Bundle and private pricing agreements cut rates meaningfully at committed volume, exactly the negotiation most AWS shops never run, and we do.
Free origin fetch is real value and real gravity: it prices multi-CDN comparisons against CloudFront’s favor. Benchmark the whole picture, not just the per-GB line.
CloudFront bills by region and per 10,000 requests, so we model it from your actual traffic profile, geography mix, object sizes, request rates, then benchmark the result against the field and, at volume, negotiate the private pricing agreement AWS won’t volunteer. One number that survives contact with your invoice.
The technical checklist.
The line items we verify when benchmarking CloudFront against the field, the same checklist behind our comparison pages.
Both served at the edge.
SupportedDual-stack distributions.
SupportedWith free certificates via ACM.
SupportedEdge compression or origin pass-through.
SupportedRegional concentration of origin fetches.
Add-onStale-while-revalidate and stale-if-error supported.
SupportedInvalidations propagate in minutes, not seconds, and bill per path after the free allowance.
MinutesVia Kinesis Data Streams.
SupportedProxied by distributions.
SupportedInfrastructure-as-code native.
SupportedCloudFront Functions and Lambda@Edge, priced per use.
Add-onFree public certs via AWS Certificate Manager.
IncludedImported via ACM.
SupportedNative token access control.
SupportedCountry-level restrictions per distribution.
SupportedVia AWS WAF at the edge.
SupportedPer-field payload encryption at the edge, a genuine rarity.
SupportedShield Standard included; Advanced adds response and cost protection.
IncludedSeparate AWS China partition, own account and ICP required.
SeparateDocs, humans, status.
AWS docs: exhaustive, accurate, and sized like AWS, budget reading time. The developer community fills the narrative gaps.
AWS Support tiers from Basic to Enterprise apply account-wide; response commitments scale with the plan you pay for.
The AWS Health Dashboard, per-service, per-region status in the open.
A published availability SLA with service credits; Shield Advanced adds DDoS cost protection on top.
Where it wins. Where it doesn’t.
The honest summary we give clients before any CloudFront conversation.
Your origins live in AWS and you want delivery that’s integrated, IAM-governed and on the invoice you already reconcile, at small-to-mid volume the free tier and free origin fetch make it near-unbeatable on convenience.
The embedded-PoP tier inside ISP networks, and field-level encryption, capabilities buyers rarely know to ask about.
You’re not on AWS, purge speed matters to your workflow, invalidations take minutes, not milliseconds, or your traffic skews to premium-priced regions and small objects without a negotiated commitment behind it.
The bill is the product’s sharpest edge: regional premiums, request meters and edge-compute charges compound quietly. Model it from real traffic before scaling, it’s the first thing we check in an assessment.
CloudFront across the site.
The benchmarked head-to-heads and working guides that pair with this profile.
CloudFront questions,
answered straight.
Is CloudFront free to start?
Effectively, yes: the always-free tier includes 1 TB of transfer out per month, requests included, and data from AWS origins into CloudFront is free. Real money starts when volume, premium regions or edge compute do.
Why does the same traffic cost different amounts?
Geography and shape. Rates differ by region, with premiums outside North America and Europe, and HTTPS requests meter per 10,000, so a terabyte of small objects in São Paulo bills very differently from a terabyte of video in Frankfurt. This is why we model from your real traffic.
Does CloudFront cover mainland China?
No. AWS China is a separate partition run by local partners, with its own accounts and an ICP requirement; the global network serves Chinese users from outside the mainland. When China matters, we structure an in-country lane alongside.
How fast is cache invalidation?
Minutes, not milliseconds, and paths beyond the monthly free allowance bill individually. If purge speed is part of your publishing workflow, this is the line item to weigh against the instant-purge networks.
Can the rates be negotiated?
At volume, yes: private pricing agreements and the Security Savings Bundle move the numbers meaningfully. Most AWS shops never ask; arriving with cross-market benchmarks is what makes AWS sharpen the pencil, and that’s the negotiation we run.
How does CloudFront compare to Cloudflare?
CloudFront wins inside AWS estates on integration and origin economics; Cloudflare wins on platform breadth, purge speed and self-serve pricing clarity. The full head-to-head is in our comparison.
All product names, logos and brands are the property of their respective owners and are used for identification purposes only. CDN World is an independent advisory and is not endorsed by, sponsored by, or affiliated with any provider listed unless expressly stated. Provider information is published for general information and may change without notice, please confirm current details directly with the provider before relying on them.