Opportunity Name

Purchase CloudFront Flat-Rate Pricing Plan

AWS Resource Type

Amazon CloudFront (distributions)

Opportunity Description

In November 2025, AWS introduced flat-rate pricing plans for CloudFront. Instead of metered pay-as-you-go charges per GB of data transfer and per 10,000 requests, you subscribe an individual distribution to a fixed monthly plan: Free ($0), Pro ($15), Business ($200), or Premium ($1,000), with no overage charges. Each plan bundles CloudFront CDN, AWS WAF with DDoS protection, Amazon Route 53 DNS, CloudWatch Logs ingestion, S3 Standard storage credits, a free auto-renewing TLS certificate, CloudFront Functions, and the edge key-value store into that single price.

This CloudFix Finder reads your Cost and Usage Report to establish each distribution's actual monthly data transfer, request count, and cost, then inspects the live distribution configuration through the CloudFront API. It selects the cheapest plan tier that covers both your measured usage and the features your distribution actually uses, compares the total current monthly cost against that plan's price, and produces a per-distribution recommendation with a full four-tier comparison table. Where a distribution uses a legacy feature that AWS rejects at enrolment, the recommendation still ships and the report lists exactly what to remediate first.

Criteria for Identifying the Opportunity

The Finder first selects candidate distributions from your CUR, then validates each one against the live CloudFront configuration.

Plan tiers and limits used for selection

How cache behaviors are counted. The cache-behavior limit applies to the total number of behaviors on the distribution — your default cache behavior plus every additional cache behavior. A distribution with a default behavior and four additional behaviors totals five and still fits the Free tier; adding a sixth additional behavior brings the total to seven and elevates the recommendation to Pro.

Headroom buffer. Before matching your usage to a tier, the Finder multiplies both your measured monthly data transfer and your measured monthly request count by 1.2 — a 20% headroom buffer — so that a distribution is not recommended for a tier it would outgrow on a small traffic increase. A distribution serving 85 GB a month is evaluated as 102 GB, which exceeds the Free tier's 100 GB allowance, so it is recommended for Pro rather than Free. In practice this puts the ceiling for a Free recommendation at roughly 83 GB of measured monthly data transfer. AWS states that flat-rate allowances are not hard limits and that a first spike of up to 3x is forgiven, but CloudFix stays deliberately conservative.

Feature-driven tier elevation. Some distribution features are only offered from a certain tier upward. The Finder raises the recommendation to whichever is higher — the tier your usage needs, or the tier your configuration needs.

AWS-managed policies such as CachingOptimized, CachingDisabled, AllViewer, and SecurityHeadersPolicy do not count as custom and do not push the recommendation upward. Lambda@Edge does not elevate the tier either — it is usable on every flat-rate tier and is simply billed separately.

Prerequisites rather than rejections. AWS refuses enrollment while certain legacy features are present, but each has a published migration path. The Finder still issues the recommendation and lists the required work in the report with an effort rating, so you can decide whether the savings justify it:

A distribution with a fully modern configuration produces an empty prerequisites list.

What this Finder cannot see. The prerequisites above are detected by inspecting the CloudFront distribution configuration only. AWS also refuses flat-rate enrollment for several conditions that live outside that configuration, and this Finder does not query for them:

• AWS WAF features on the attached Web ACL: Targeted Bots, CAPTCHA, Partner Managed Rules, Rule Groups, Account Creation Fraud Prevention, and Account Takeover Protection

• Web ACLs managed by AWS Firewall Manager

• AWS Shield Advanced enabled on the distribution

• CloudFront Functions or WAF Web ACLs shared across multiple distributions

An empty prerequisites list therefore means the distribution's CloudFront configuration is compatible — not that AWS will certainly accept the enrollment. Check these items yourself before starting any remediation work, as described in the manual steps below.

Potential Savings

Savings are the difference between what the distribution and its bundled services cost you today and the flat monthly price of the recommended plan:

current monthly cost = CloudFront amortized cost

                     + (WAF Web ACL cost / number of candidate distributions sharing that ACL)

                     + Shield Advanced data transfer cost for the distribution

monthly savings      = current monthly cost - plan monthly cost

annual savings       = monthly savings x 12

The WAF component is attributed per Web ACL from your CUR, and where several candidate distributions reference the same Web ACL, its cost is divided equally among them rather than credited in full to any one of them. Shield Advanced data transfer charges are included because Shield must be disabled before a distribution can enroll, so those charges go away; the separate organization-level Shield Advanced subscription fee is not modeled.

A worked example from the analysis behind this Finder: a distribution serving roughly 6 TB of data transfer and 2.1 million requests a month cost about $429 a month on pay-as-you-go. That usage sits well inside the Pro plan's 50 TB and 10 million request allowances, so the recommendation is Pro at $15 a month — approximately $414 a month, or $4,968 a year, for that single distribution.

What Happens When the Fixer Is Executed?

Note: this is a recommendation-only opportunity. CloudFix does not perform any automated fix.  The plans can only be managed in the AWS Console, so no automation is possible.

CloudFix generates a per-distribution report containing:

• The AWS account and distribution ID

• Current monthly CloudFront cost, WAF cost share, and Shield Advanced data transfer cost

• Measured monthly data transfer and request count

• A four-tier comparison table showing each plan's cost, your usage against its allowances, whether it is eligible, any configuration blockers, and the monthly and annual savings it would deliver

• The recommended tier with a cost breakdown and remaining headroom on data transfer and requests

• A prerequisites table, if any legacy features must be remediated first

• A note if the account holds a Security Savings Bundle, or if the distribution is protected by Shield Advanced

To apply the recommendation manually:

1. Before starting any remediation work, check the items the Finder cannot see: inspect the attached Web ACL for CAPTCHA, Rule Groups, Targeted Bots, Partner Managed Rules, Account Creation Fraud Prevention, and Account Takeover Protection; confirm the Web ACL is not managed by AWS Firewall Manager; and confirm the Web ACL and any CloudFront Functions are not shared with other distributions. Any of these will cause AWS to refuse enrollment.

2. Work through any prerequisites listed in the report, and confirm the distribution has finished deploying afterward.

3. If the distribution is protected by AWS Shield Advanced, disable Shield Advanced for it — AWS does not permit flat-rate enrollment while Shield Advanced is enabled on the distribution, and the savings figure in the report already assumes it will be turned off. Weigh this against your DDoS-protection requirements: flat-rate plans include always-on AWS WAF with DDoS protection, but that is not equivalent to Shield Advanced.

4. If the account holds a CloudFront Security Savings Bundle, cancel it. The two cannot be combined.

5. In the AWS Console, open CloudFront, select the distribution, and choose the pricing plan named in the recommendation.

6. Check the non-adjustable account quotas before enrolling at scale: a maximum of 100 pricing plans per account, a maximum of three Free plans per account, one apex domain per plan, and flat-rate plans cannot be used with AWS Free Tier accounts.

Once subscribed, upgrades take effect immediately with prorated price and allowance. Downgrades take effect at the next billing cycle and are blocked if current usage exceeds the target tier. Cancellation takes effect at the end of the current billing cycle, and a distribution cannot be deleted while a plan is attached to it.

Is It Possible to Roll Back Once CloudFix Implements the Fixer?

Not applicable — this is a recommendation-only opportunity, and CloudFix does not apply any change. If you enroll a distribution yourself and want to reverse it, you can cancel the pricing plan in the CloudFront console; the cancellation takes effect at the end of the current billing cycle and the distribution returns to pay-as-you-go pricing. Any prerequisite work you did to qualify — migrating OAI to OAC, replacing ForwardedValues with an origin request policy — is a configuration change you would need to unwind separately, and in most cases it is worth keeping regardless of the pricing plan.

Can CloudFix Implement the Fix Automatically Once I Accept the Recommendation?

No. AWS does not yet expose a public API for managing CloudFront pricing plans, so no automation is possible from CloudFix or from any infrastructure-as-code tool. You must enroll the distribution yourself in the AWS Console after reviewing the recommendation. 

Does This Fix Require Downtime?

Subscribing a distribution to a flat-rate pricing plan is a billing change and does not require downtime — traffic continues to be served throughout.

The prerequisite remediations can require distribution updates, which deploy without an outage but do propagate across edge locations and should be treated as configuration changes: migrating a cache behavior from inline TTLs or ForwardedValues to cache and origin request policies alters caching behavior and should be validated in a lower environment first, and migrating an S3 origin from OAI to OAC requires a coordinated bucket policy update to avoid serving errors during the transition. Switching a viewer certificate from dedicated IP to SNI drops support for very old clients that do not send SNI.

After enrollment, sustained usage beyond your tier's allowance is never billed as an overage, but AWS may progressively adjust performance — serving from fewer or more distant edge locations — if the excess persists across billing periods. AWS sends email alerts at 50%, 80%, and 100% of the monthly allowance, and the 20% headroom buffer CloudFix applies is intended to keep you well clear of that point.

Additional Resources

• CloudFront flat-rate pricing plans — tiers, allowances, features by tier, and unsupported features

• Introducing flat-rate pricing plans with no overages — AWS Networking and Content Delivery blog

• AWS flat-rate pricing plans announcement

• Understanding cache policies — for migrating off legacy TTL settings

• Controlling origin requests — for migrating off ForwardedValues

• Migrating from origin access identity (OAI) to origin access control (OAC)

• Switching from a dedicated IP address to SNI

• Real-time logs — for moving to standard access logs

• Amazon CloudFront pricing

AWS introduced flat-rate pricing plans for CloudFront.