All Services
Networking & CDN
Amazon CloudFront
Amazon CloudFront is a global content delivery network and reverse proxy that serves cached or dynamic content through edge locations, using distributions, origins, cache behaviors, policies, TLS, signed access, functions, logs, and security integrations.
Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with Amazon CloudFront.
Amazon CloudFront pricing and cost programs
Pricing model: Edge delivery usage
- On-Demand
- Available
- Reserved Instances or reserved capacity
- Not applicable
- Savings Plans
- Service-specific
- Spot
- Not applicable
Billing dimensions: Data transfer out · Requests · Edge compute · Invalidations and logs
Programs and modes: Pay-as-you-go · Free Tier offers · CloudFront Savings Bundle · Custom pricing
Savings Bundle and custom pricing are CloudFront-specific commitments, not AWS Savings Plans.
Free Tier: Available — verify current offers
Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.
Official AWS pricing
Official AWS sources reviewed 2026-07-21.
Why implement Amazon CloudFront?
- Reduces latency and origin load through global edge caching, persistent connections, compression, protocol optimization, and origin shielding options.
- Provides managed TLS, custom domains, multiple origins and behaviors, invalidations, signed URLs or cookies, and edge compute.
- Integrates with S3 origin access control, Elastic Load Balancing, API Gateway, WAF, Shield, ACM, Route 53, logs, and real-time metrics.
How to implement Amazon CloudFront
- Inventory content paths, methods, query strings, headers, cookies, identities, freshness, invalidation, residency and origin-failover requirements; create distinct behaviors only when policy differs.
- Create a distribution with the smallest cache key, a separate minimal origin-request policy, modern TLS and HTTPS redirects, compression, error behavior, logs, WAF and signed access where needed; use origin access control for private S3 origins.
- Prevent origin bypass with resource or network controls, test cache variation and authorization, deploy changes progressively, and monitor cache-hit ratio, origin latency, status codes, WAF findings, invalidations, transfer and request cost.
Amazon CloudFront best practices
- Keep the cache key as small as correctness permits and forward only required viewer values to the origin; excessive headers, cookies, or query strings fragment the cache and raise origin load.
- Use HTTPS end to end, modern security policies, WAF and Shield where appropriate, signed URLs or cookies for private content, and origin access control plus an S3 policy that blocks direct public access.
- Version immutable assets instead of relying on frequent invalidations, set TTLs to match update and failure tolerance, validate sensitive-response caching, and use logs and alarms to distinguish edge from origin failures.
Amazon CloudFront use cases and server impact
- Global websites and static assets
- API and dynamic application acceleration
- Private downloads, video, and software distribution
Replaces edge cache and reverse-proxy fleets and reduces origin capacity, while cache correctness, origin security, application authorization, edge code, logging, invalidation, and cost design remain yours.
Official implementation resources
How Amazon CloudFront works with other AWS services
Arrows show the documented technical direction. Reciprocal navigation does not imply a reverse technical dependency.
Official AWS sources reviewed 2026-07-25.
Amazon Route 53 → Amazon CloudFront
A Route 53 alias record resolves an application hostname to a CloudFront distribution; CloudFront then handles viewer requests at the edge.
- Why teams use it
- Teams keep DNS routing separate from content delivery while avoiding an extra DNS query for a CNAME at the zone apex.
- Permissions and networking
- The alias name must match a distribution alternate domain name, and the distribution needs a certificate that covers that hostname.
- Pricing and security caveats
- Route 53 queries and CloudFront requests are billed separately. DNS routing does not make CloudFront depend on Route 53; another DNS provider can point at the distribution.
AWS Certificate Manager → Amazon CloudFront
CloudFront uses an ACM certificate attached to the distribution to terminate HTTPS for alternate domain names.
- Why teams use it
- Managed certificate renewal reduces manual certificate operations for public web delivery.
- Permissions and networking
- The viewer certificate must be requested or imported in us-east-1 and cover every alternate domain name on the distribution.
- Pricing and security caveats
- Public ACM certificates used with integrated services have no additional certificate charge, but CloudFront transfer and request charges still apply.
AWS WAF → Amazon CloudFront
A web ACL associated with CloudFront evaluates viewer HTTP requests before CloudFront forwards allowed requests to an origin.
- Why teams use it
- Rules can block common exploits, rate-limit abusive clients, and reduce unwanted origin traffic at the edge.
- Permissions and networking
- Scope the web ACL for CloudFront, test managed and custom rules in count mode, and protect access to the origin independently.
- Pricing and security caveats
- AWS WAF charges for web ACLs, rules, and requests in addition to CloudFront. Rules can create false positives and do not replace application authorization.
Amazon CloudFront → Amazon Simple Storage Service
CloudFront returns cached objects and, on a cache miss, requests the object from an S3 origin.
- Why teams use it
- The pairing provides global caching in front of durable object storage and reduces direct origin traffic.
- Permissions and networking
- Prefer origin access control with a bucket policy that grants only the distribution access; keep the S3 bucket non-public.
- Pricing and security caveats
- CloudFront, S3 storage, S3 requests, and applicable data transfer are distinct billing dimensions. Cache invalidations and stale-content strategy need deliberate handling.
Architecture patterns using this service