Skip to content
inetGeek

Amazon CloudFront vs Cloudflare

SEPT 2026 audit

A comparison of Amazon CloudFront and Cloudflare built from values read directly from each provider's own documentation, with the source recorded against every figure.

Reviewed by Palash BagchiUpdated 20 criteria comparedSources last checked

Adoption share

BuiltWith counts — how much more of the web runs Cloudflare than Amazon CloudFront, among the sites BuiltWith actually detects. Measured . Source: BuiltWith.

Cloudflare95.3% · 54,638,083 sites
Amazon CloudFront4.7% · 2,703,106 sites

The short answer

Choose Amazon CloudFront if…

Teams already on AWS that want CDN bundled with other AWS services under one flat monthly price rather than itemized per-GB billing.

Editorial · Palash Bagchi · approved

Choose Cloudflare if…

Teams that want CDN, DDoS protection and WAF bundled together and effectively unmetered on bandwidth — the pricing axis here is feature tier, not gigabytes served.

Editorial · Palash Bagchi · approved

Consider something else if…

  • Amazon CloudFront: Traffic profile is unusual or very high volume — the flat-rate plans bundle a fixed allowance, and a metered pay-as-you-go CDN may price better outside that shape.
  • Cloudflare: The workload needs Cloudflare's edge-compute or storage products alongside the CDN — those are priced and profiled separately (see Cloudflare Pages, Cloudflare R2), not part of this plan.

Neither quite fits? Every other option, ranked by iScore: Amazon CloudFront alternatives · Cloudflare alternatives

17 sourced criteria separate them — see where, with sources, below.

Visit Amazon CloudFront documentationVisit Cloudflare documentation

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

01.

At a glance.

CriterionAmazon CloudFrontCloudflare
Pricing
Free tierYesYes
Kind of free offerFree tierFree tier
Entry paid plan
Pro plan: $15/month.
Pro plan: $20/month billed annually, or $25/month billed monthly.
Pricing modelFlat-rate monthly plans bundling CloudFront with multiple AWS services and features, with no overage charges within plan limits.Flat monthly plans that differ by feature set rather than by traffic: Free, Pro at $20/mo billed annually, Business at $200/mo billed annually, and a custom Contract tier.
Egress over allowanceNo overage charges on the flat-rate plans; past the monthly allowance AWS may adjust delivery instead of billing - for example serving traffic from fewer or more distant edge locations. Data transfer allowance: 100 GB Free, 50 TB Pro/Business/Premium, Premium configurable up to 600 TB.Bundled into the plan price: Cloudflare states bandwidth costs are bundled rather than charged as cloud egress fees; no per-GB CDN rate is quoted.
Infrastructure
RegionsGlobal edge network: PoPs in 100+ cities across 50+ countries, plus 15 regional edge caches (RECs) sited within AWS Regions.8 regions, listed alongside 348 cities in the Data Center Locations section of the global network page. Cloudflare's own regional grouping of its data centres, not cloud-style deployment regions.
Uptime SLA
99.9% monthly uptime, one figure with no configuration split.
100%, on Business and Enterprise only — Free and Pro carry none. Service credits are 1x on Business and 10x standard or 25x premium on Enterprise.
CDN
Points of presenceHundreds of edge locations (exact count not published on the pricing page).348 cities in the Data Center Locations list on Cloudflare's global network page.
Image optimizationDynamic Image Transformation for Amazon CloudFront (formerly Serverless Image Handler): an AWS Solution you deploy into your own account for real-time image processing through the CloudFront CDN.Lossless Image Optimization included from the Pro plan, alongside AMP support.
Compliance
SOC 2Listed as SOC-compliant on AWS's own compliance scope page. — Excludes content delivery through CloudFront Embedded Points of Presence.SOC 2 Type II attestation covering Security, Confidentiality and Availability against the AICPA Trust Service Criteria.
ISO 27001Covered under AWS's account-wide ISO/IEC 27001:2022 certification — not scoped per-service the way SOC, HIPAA and PCI DSS are on AWS's own site.ISO 27001:2022 certified — an Information Security Management System (ISMS) and security risk management processes certification. ISO 27017, 27018 and 27701 are listed on the same page.
HIPAAListed as a HIPAA-eligible service on AWS's own reference page. — Excludes content delivery through CloudFront Embedded Points of Presence.HIPAA is listed in Cloudflare's certifications; the HIPAA AoC is obtained by contacting your account team.
GDPR / data residencyAWS customers can process personal data on all AWS services in compliance with GDPR, and choose the storage type and geographic region for their data.Data Localization Suite, an Enterprise-only paid add-on, chooses where Cloudflare inspects and stores data, for regimes such as GDPR.
PCI DSSListed as PCI DSS-compliant on AWS's own compliance scope page. — Excludes content delivery through CloudFront Embedded Points of Presence.PCI DSS 4.0 Attestation of Compliance, listed among Cloudflare's certifications and reports.
Encryption at rest
CloudFront Functions code and configuration is always stored in an encrypted format on the edge location PoPs and in CloudFront's other storage locations.
DPA Annex 2 requires all disks storing Personal Data to be encrypted with AES-XTS at a key length of 128 bits or longer.
Customer-managed keys
Field-level encryption uses an RSA public key you supply: CloudFront encrypts the named POST fields at the edge and only your private key can decrypt them.
Keyless SSL keeps TLS private keys on a customer-run key server; only for Enterprise customers holding their own CA-issued certificate. Availability table on the same page: No on Free, Pro and Business; paid add-on on Enterprise.
Role-based access controlIAM managed policies CloudFrontReadOnlyAccess and CloudFrontFullAccess attach to users, groups and roles, alongside custom identity-based policies.On any Cloudflare account, members are granted access through policies made of an actor, a role and a scope; roles are account-, domain- or resource-scoped.
Private networking / VPCVPC origins: CloudFront serves ALBs, NLBs and EC2 instances in private subnets over a private connection, with no public access to the origin. Listed as "Private Origins Within VPC" from the Business flat-rate plan upward on the CloudFront pricing page.Cloudflare Network Interconnect, Enterprise-only, connects your network infrastructure directly to Cloudflare rather than over the public Internet.
Dedicated infrastructureDedicated IP custom SSL costs $600/month per certificate; Anycast Static IPs provide a dedicated set of static IP addresses for distributions.CNI Direct Interconnect gives a dedicated physical fiber connection into Cloudflare hardware that sits in a shared data center. Dedicated connectivity into a shared network; no single-tenant CDN deployment is published.

Only criteria both providers publish appear here; a tinted cell marks a real difference. Criteria only one of them documents are listed below, and an absence there means we found no source — not that the feature is missing. How we source this.

The small bar above a value is inetGeek's own lean toward that side — computed from the same facts shown, never a number the provider published. See the picker below "The short answer" to weigh only the criteria you care about.

02.

Where they differ.

Entry paid plan

Amazon CloudFront
Pro plan: $15/month.
Cloudflare
Pro plan: $20/month billed annually, or $25/month billed monthly.
Sources (2) →

Pricing model

Amazon CloudFront
Flat-rate monthly plans bundling CloudFront with multiple AWS services and features, with no overage charges within plan limits.
Cloudflare
Flat monthly plans that differ by feature set rather than by traffic: Free, Pro at $20/mo billed annually, Business at $200/mo billed annually, and a custom Contract tier.
Sources (2) →
  • Amazon CloudFront Pricing ↗

    “Flat-rate pricing plans combine the CloudFront CDN with multiple AWS services and features into a monthly price with no overage charges.”

    Read 2026-09-11 · official pricing · Report a correction

  • Cloudflare Plans ↗

    “Free For personal or hobby projects that aren't business-critical. $0 /month [...] Pro For professional websites that aren't business-critical. $20 /mo billed annually, or $25/mo billed monthly [...] Business For small businesses operating online. $200 /mo billed annually, or $250/mo billed monthly [...] Contract For mission-critical applications that are core to your business. Custom Billed annually”

    Read 2026-09-13 · official pricing · Report a correction

Egress over allowance

Amazon CloudFront
No overage charges on the flat-rate plans; past the monthly allowance AWS may adjust delivery instead of billing - for example serving traffic from fewer or more distant edge locations. Data transfer allowance: 100 GB Free, 50 TB Pro/Business/Premium, Premium configurable up to 600 TB.
Cloudflare
Bundled into the plan price: Cloudflare states bandwidth costs are bundled rather than charged as cloud egress fees; no per-GB CDN rate is quoted.
Sources (2) →

Regions

Amazon CloudFront
Global edge network: PoPs in 100+ cities across 50+ countries, plus 15 regional edge caches (RECs) sited within AWS Regions.
Cloudflare
8 regions, listed alongside 348 cities in the Data Center Locations section of the global network page. Cloudflare's own regional grouping of its data centres, not cloud-style deployment regions.
Sources (2) →

Uptime SLA

Amazon CloudFront
99.9% monthly uptime, one figure with no configuration split.
Cloudflare
100%, on Business and Enterprise only — Free and Pro carry none. Service credits are 1x on Business and 10x standard or 25x premium on Enterprise.
Sources (2) →
  • Amazon CloudFront Service Level Agreement ↗

    “for the billing cycle in which the error occurred in accordance with the schedule below. Monthly Uptime Percentage Service Credit Percentage Less than 99.9% but greater than or equal to 99.0% 10%”

    Read 2026-09-14 · official site · Report a correction

  • Cloudflare Plans ↗

    “uptime SLA free - pro - business 100% contract 100% [...] uptime service credits free - pro - business 1x contract 10x (standard); 25x (premium)”

    Read 2026-09-14 · official pricing · Report a correction

Points of presence

Amazon CloudFront
Hundreds of edge locations (exact count not published on the pricing page).
Cloudflare
348 cities in the Data Center Locations list on Cloudflare's global network page.
Sources (2) →

Image optimization

Amazon CloudFront
Dynamic Image Transformation for Amazon CloudFront (formerly Serverless Image Handler): an AWS Solution you deploy into your own account for real-time image processing through the CloudFront CDN.
Cloudflare
Lossless Image Optimization included from the Pro plan, alongside AMP support.
Sources (2) →

SOC 2

Amazon CloudFront
Listed as SOC-compliant on AWS's own compliance scope page. — Excludes content delivery through CloudFront Embedded Points of Presence.
Cloudflare
SOC 2 Type II attestation covering Security, Confidentiality and Availability against the AICPA Trust Service Criteria.
Sources (2) →

ISO 27001

Amazon CloudFront
Covered under AWS's account-wide ISO/IEC 27001:2022 certification — not scoped per-service the way SOC, HIPAA and PCI DSS are on AWS's own site.
Cloudflare
ISO 27001:2022 certified — an Information Security Management System (ISMS) and security risk management processes certification. ISO 27017, 27018 and 27701 are listed on the same page.
Sources (2) →

HIPAA

Amazon CloudFront
Listed as a HIPAA-eligible service on AWS's own reference page. — Excludes content delivery through CloudFront Embedded Points of Presence.
Cloudflare
HIPAA is listed in Cloudflare's certifications; the HIPAA AoC is obtained by contacting your account team.
Sources (2) →

GDPR / data residency

Amazon CloudFront
AWS customers can process personal data on all AWS services in compliance with GDPR, and choose the storage type and geographic region for their data.
Cloudflare
Data Localization Suite, an Enterprise-only paid add-on, chooses where Cloudflare inspects and stores data, for regimes such as GDPR.
Sources (2) →
  • GDPR — Amazon Web Services ↗

    “AWS customers can use all AWS services to process personal data [...] in compliance with the GDPR. [...] Customers have control of their customer data. With AWS, customers can: Determine where their customer data will be stored, including the type of storage and geographic region of that storage.”

    Read 2026-09-12 · official site · Report a correction

  • Data Localization Suite · Cloudflare Docs ↗

    “Enterprise-only paid add-on [...] The Data Localization Suite (DLS) is a collection of tools that enable customers to choose the location where Cloudflare inspects and stores data, while maintaining the security and performance benefits of our global network.”

    Read 2026-09-13 · official docs · Report a correction

PCI DSS

Amazon CloudFront
Listed as PCI DSS-compliant on AWS's own compliance scope page. — Excludes content delivery through CloudFront Embedded Points of Presence.
Cloudflare
PCI DSS 4.0 Attestation of Compliance, listed among Cloudflare's certifications and reports.
Sources (2) →

Encryption at rest

Amazon CloudFront
CloudFront Functions code and configuration is always stored in an encrypted format on the edge location PoPs and in CloudFront's other storage locations.
Cloudflare
DPA Annex 2 requires all disks storing Personal Data to be encrypted with AES-XTS at a key length of 128 bits or longer.
Sources (2) →

Customer-managed keys

Amazon CloudFront
Field-level encryption uses an RSA public key you supply: CloudFront encrypts the named POST fields at the edge and only your private key can decrypt them.
Cloudflare
Keyless SSL keeps TLS private keys on a customer-run key server; only for Enterprise customers holding their own CA-issued certificate. Availability table on the same page: No on Free, Pro and Business; paid add-on on Enterprise.
Sources (2) →

Role-based access control

Amazon CloudFront
IAM managed policies CloudFrontReadOnlyAccess and CloudFrontFullAccess attach to users, groups and roles, alongside custom identity-based policies.
Cloudflare
On any Cloudflare account, members are granted access through policies made of an actor, a role and a scope; roles are account-, domain- or resource-scoped.
Sources (2) →

Private networking / VPC

Amazon CloudFront
VPC origins: CloudFront serves ALBs, NLBs and EC2 instances in private subnets over a private connection, with no public access to the origin. Listed as "Private Origins Within VPC" from the Business flat-rate plan upward on the CloudFront pricing page.
Cloudflare
Cloudflare Network Interconnect, Enterprise-only, connects your network infrastructure directly to Cloudflare rather than over the public Internet.
Sources (2) →
  • Restrict access with VPC origins - Amazon CloudFront ↗

    “You can use CloudFront to deliver content from applications that are hosted in your virtual private cloud (VPC) private subnets. [...] You can use Application Load Balancers (ALBs), Network Load Balancers (NLBs), and EC2 instances in private subnets as VPC origins. [...] User requests go from CloudFront to the VPC origins over a private, secure connection”

    Read 2026-09-13 · official docs · Report a correction

  • Cloudflare Network Interconnect · Cloudflare Docs ↗

    “Enterprise-only [...] Cloudflare Network Interconnect (CNI) allows you to connect your network infrastructure directly to Cloudflare — rather than using the public Internet — for a more performant and secure experience.”

    Read 2026-09-13 · official docs · Report a correction

Dedicated infrastructure

Amazon CloudFront
Dedicated IP custom SSL costs $600/month per certificate; Anycast Static IPs provide a dedicated set of static IP addresses for distributions.
Cloudflare
CNI Direct Interconnect gives a dedicated physical fiber connection into Cloudflare hardware that sits in a shared data center. Dedicated connectivity into a shared network; no single-tenant CDN deployment is published.
Sources (2) →

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

03.

Documented by only one.

These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing — except where we say we read the other provider's own page on a given date and it does not state it. Those rows lean, and the provider can correct them with a link.

Credit card to startCloudflare: No
04.

Questions this comparison answers.

Entry paid plan: Amazon CloudFront or Cloudflare?

Amazon CloudFront: Pro plan: $15/month.

Cloudflare: Pro plan: $20/month billed annually, or $25/month billed monthly.

Egress over allowance: Amazon CloudFront or Cloudflare?

Amazon CloudFront: No overage charges on the flat-rate plans; past the monthly allowance AWS may adjust delivery instead of billing - for example serving traffic from fewer or more distant edge locations. Data transfer allowance: 100 GB Free, 50 TB Pro/Business/Premium, Premium configurable up to 600 TB.

Cloudflare: Bundled into the plan price: Cloudflare states bandwidth costs are bundled rather than charged as cloud egress fees; no per-GB CDN rate is quoted.

Should I choose Amazon CloudFront or Cloudflare?

Pick Amazon CloudFront if Teams already on AWS that want CDN bundled with other AWS services under one flat monthly price rather than itemized per-GB billing.

Pick Cloudflare if Teams that want CDN, DDoS protection and WAF bundled together and effectively unmetered on bandwidth — the pricing axis here is feature tier, not gigabytes served.

Provider pages

Amazon CloudFrontAWS's CDN, sold in flat-rate monthly plans bundling CloudFront with other AWS services rather than metered bandwidth alone.CloudflareCloudflare's core network plans — CDN, DDoS protection and WAF bundled into flat tiers rather than metered bandwidth.

Related comparisons

Amazon CloudFront vs Azure Front DoorAmazon CloudFront vs Bunny CDNAmazon CloudFront vs FastlyAmazon CloudFront vs KeyCDNAzure Front Door vs CloudflareCloudflare vs Bunny CDNCloudflare vs FastlyCloudflare vs KeyCDN

Comments

Every page here is sourced and dated.