Amazon CloudFront flat-rate pricing plans: new features and expanded capabilities

In November 2025, we launched flat-rate pricing plans for Amazon CloudFront. Since launch, customers have shared feedback and we’ve been adding new capabilities. This post covers what’s new: support for Lambda@Edge, CAPTCHA, mutual TLS (mTLS), and an AI activity dashboard for visibility into AI bot and agent traffic. We’ve also clarified how plans handle traffic beyond the usage allowance.

What are flat-rate pricing plans?

Flat-rate plans give you everything you need to deliver and protect your website or application for a single monthly price with no overage charges, regardless of traffic spikes or attacks. Plans combine CloudFront CDN, AWS WAF, distributed denial of service (DDoS) protection, bot management, Amazon Route 53 DNS, Amazon CloudWatch Logs ingestion, serverless edge compute, and Amazon Simple Storage Service (Amazon S3) storage credits into one monthly price based on the plan tier you select.

Plans are available in Free ($0/month), Pro ($15/month), Business ($200/month), and Premium ($1,000/month) tiers. Each tier offers different features and is designed for different levels of traffic. You can upgrade anytime, and no annual commitment is required.

New features and capabilities

In the four months since the plans launched, hundreds of thousands of customers have used these plans to secure and accelerate their websites with predictable pricing. As with any AWS feature or service, we listen to customers and introduce new enhancements. For example, some customers told us they were excited about flat-rate plans but couldn’t adopt them because their existing configurations used features that weren’t yet supported in the plans. They wanted predictable monthly pricing without changing how their applications work. As a result, we’ve added new capabilities based on what customers are telling us they need. Here they are:

AI activity dashboard. A new AI activity dashboard in AWS WAF is designed to give you visibility into AI bot and agent traffic reaching your applications. You can see traffic trends over time, identify the most active bots and frequently accessed paths, and analyze requests by bot category and verification status. The dashboard is included with all paid plans starting at the Pro tier. Bot management controls, which let you take action on AI bot traffic, are available starting at the Business tier and above through AWS WAF Bot Control.

Lambda@Edge and CAPTCHA support. Customers using Lambda@Edge or CAPTCHA in their AWS WAF rules can now use flat-rate pricing plans. Previously, distributions using these features were unavailable as part of a plan subscription, and distributions on a plan couldn’t enable them. CAPTCHA responses configured in your AWS WAF rules are included in your plan’s price. Lambda@Edge is now supported on all plan tiers, with invocations billed at standard pay-as-you-go rates on top of your plan price.

Mutual TLS (mTLS). We’ve added mTLS support to flat-rate plans. Origin mTLS, available in the Business tier and above, enables only your authorized CloudFront distributions to connect to your application. This joins existing security options such as origin access control (OAC), which uses signature verification to restrict access to your application, and virtual private cloud (VPC) private origins, which keep your application in a private subnet accessible only through CloudFront and hidden from the public internet. Together, these features help you ensure that all traffic routes through CloudFront and your AWS WAF security rules before reaching your application. Viewer mTLS, available in the Premium tier, lets you require clients to present a valid certificate before connecting to your application.

How plans handle traffic beyond your usage allowance

Flat-rate plans offer a monthly price with no overage charges. There are no surprise charges when traffic spikes, no billing anxiety during a viral moment, and no penalty for a successful launch. Each plan includes a usage allowance designed for optimal performance at that tier. Usage allowances are not hard limits. You get predictable pricing and reliable performance. We’ll notify you as you approach your allowance at 50%, 80%, and 100%, and you can monitor your usage in the console anytime.

After launch, some customers asked for more clarity about how plans accommodate traffic beyond the monthly usage allowance. Here’s what we’ve clarified about how plans handle traffic above the allowance:

Your first spike, up to three times your monthly allowance, is fully accommodated that month. Beyond that, excess usage is evaluated over multiple months. Only in cases of significant, prolonged excess above your usage allowance would we adjust how we deliver your traffic. Most customers never experience a change. You will not incur overage charges. You can upgrade to a higher tier at any time.

When you convert an existing distribution to a flat-rate plan or change your plan tier, the CloudFront console will show your historical usage relative to the usage allowance for each plan tier to make the selection process convenient.

Read the full details on how usage allowances work.

Getting started

Whether you’re building new applications or already running on Amazon Web Services (AWS), you can get started with flat-rate plans today. Visit the CloudFront console to subscribe a new or existing distribution to a plan. You can mix flat-rate plans and pay-as-you-go pricing across different distributions, giving you the flexibility to choose the right pricing model for each application.

View plans and pricing or visit the CloudFront Developer Guide to learn more.

About the author

Cristian Graziano

Cristian Graziano is a Principal Product Manager with Amazon CloudFront based out of Seattle. He works across product, engineering, and UX to help first-time and experienced AWS customers of all sizes quickly onboard, configure, and manage Amazon CloudFront and related AWS services.