Updated October 25, 2026
· ~3 min read
For years the comparison was easy to summarize: Cloudflare was a flat monthly price with security bundled, CloudFront was metered and WAF cost extra. In November 2025 AWS launched CloudFront flat-rate plans. Free, Pro ($15), Business ($200) and Premium ($1,000) a month bundle the CDN, AWS WAF, DDoS protection, bot management, Route 53 DNS, log ingestion and S3 storage credits, with no overage charges.
That makes this a closer call than it used to be. Price is now similar at the low end. What separates the two is where your origin lives, what else you want from the edge, and who on the team will run it.
Every plan includes AWS WAF with managed rules and IP rate limiting, geo-blocking, a TLS certificate, Route 53 hosting for an attached zone (with ALIAS queries to CloudFront free) and CloudFront Functions. Pro adds access logs with CloudWatch Logs ingestion included and the edge KeyValueStore. Business adds VPC origins and origin mutual TLS. Premium adds Origin Shield and viewer mTLS. A distribution on a plan must have a WAF web ACL attached, and some features are not supported: real-time logs, continuous deployment (staging distributions), multi-tenant distributions, WAF rule groups, partner managed rules, Targeted Bots, and account takeover and account creation fraud prevention. Lambda@Edge works on every tier but is billed pay-as-you-go. Legacy configuration (origin access identity, ForwardedValues, legacy cache settings) has to be migrated first. If you depend on one of those, stay on pay-as-you-go for that distribution.
Data transfer from S3, ALB or API Gateway to CloudFront is free. Data transfer from AWS to Cloudflare is ordinary internet egress, $0.09/GB for the first 10 TB a month in US East after the account-wide 100 GB free allowance. AWS is not in Cloudflare's Bandwidth Alliance. So the cost of Cloudflare in front of AWS depends on cache hit ratio. A static site at 98% hits pays almost nothing. An API or personalized pages that miss the cache pay AWS egress on every response, which can cost more than the CloudFront plan you were avoiding.
Question 1 of 3
Where does the origin run?
**Your origin is on AWS:** CloudFront is the default. Origin fetches from S3, ALB and API Gateway are free, VPC origins keep the app off the internet, and the flat-rate plans now make the bill predictable. **You want one edge in front of many clouds or hosts, or Zero Trust and a full edge platform in one place:** Cloudflare. Budget for AWS data transfer out, because Cloudflare in front of an AWS origin pays AWS egress on every cache miss. **Neither wins on its own.** Plenty of teams run Cloudflare for DNS and Zero Trust and CloudFront for delivery.
AWS Architecture Review
A focused, senior-level review of your current AWS architecture, with a prioritized list of what to fix and why.
AWS Cost Optimization & FinOps Sprint
Reduce your AWS bill by 20–60% while improving performance and reliability.
Serverless Migration
Move from expensive always-on compute to serverless architecture: reduce costs, eliminate patching, and scale automatically.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.