Cloudflare vs AWS 2026: Is It Cheaper? Prices Checked

Picking between Cloudflare and AWS feels deceptively simple-until you realize you’re comparing two entirely different categories of infrastructure. One lives at the edge of the internet, intercepting every request before it reaches your servers. The other is your servers, your databases, and your storage. Confusing them is like asking whether you need a security guard or an entire building.

Key Takeaways

Cloudflare and AWS are complementary infrastructure layers, not direct competitors - the Edge-First Stack pattern uses both for performance and cost control.

• CloudFront flat-rate plans: AWS now sells CloudFront as flat-rate plans at $0, $15, $200 and $1,000 per month with no overage charges (AWS). That narrows the price gap for sites with AWS origins.
• CDN performance: Cloudflare cites roughly 30% better performance on dynamic requests with Argo Smart Routing (Cloudflare). That is a vendor figure, and results differ by region, so test with your own traffic.
• DDoS pricing: Cloudflare’s unmetered DDoS protection is included on every plan, including Free. AWS Shield Advanced costs $3,000/month with a 1-year commitment (AWS); the CloudFront Business plan at $200/month lists advanced DDoS protection too.
• Serverless cold starts: Cloudflare Workers run in V8 isolates and are built to avoid cold starts. Since August 1, 2025, AWS bills the Lambda INIT phase for ZIP-packaged functions on managed runtimes (AWS); AWS expects minimal impact for most accounts. In October 2026 AWS announced Lambda Web Functions, which bill active CPU time instead of wall-clock duration and, by AWS’s own claim, cut cold starts sharply.
• Egress: R2 charges $0 for data egress. S3 charges $0.09/GB for the first 10 TB/month after a 100 GB free allowance, which is roughly $900/month at 10 TB.

TL;DR - Quick Pick

For pure edge delivery, WAF, and DDoS protection at any budget: Cloudflare usually wins on price and setup effort. For managed databases, compute orchestration, ML, and full-stack backend: AWS wins on ecosystem depth. For most production teams: run both together using the Edge-First Stack-Cloudflare in front, AWS behind. Unless your workload is 100% AWS-native with no public egress, in which case CloudFront stays in the family.

Last price check: 4 October 2026, against the official Cloudflare and AWS pricing and documentation pages linked in each section. Product, network and market facts updated 26 October 2026. Both vendors change prices often, so confirm before you budget.

Core Architecture Differences

Cloudflare intercepts all traffic at the network edge before requests reach AWS backend services - a fundamental architectural distinction that defines the Edge-First Stack pattern.

The fundamental mistake most engineers-especially those reading our SaaS developers guide-make is treating Cloudflare and AWS as alternatives competing for the same slot in a stack. They operate at different layers of the internet-which is precisely why they work so well together.

Amazon Web Services (AWS) is a full-stack cloud infrastructure provider. It gives you raw compute (EC2), managed databases (RDS, DynamoDB), object storage (S3), container orchestration (EKS, ECS), and over 200 additional services. AWS is where your application lives. It processes requests, stores data, and runs business logic. In Q2 2026, AWS held about 28% of a $143.4 billion quarterly cloud infrastructure services market, ahead of Microsoft at 20% and Google at 15%, which makes it the largest cloud provider (Synergy Research Group). AWS runs 39 regions with 124 Availability Zones.

Cloudflare is a reverse proxy and edge network platform. It sits in front of your infrastructure-regardless of whether that infrastructure is on AWS, GCP, or bare metal. Cloudflare’s network of 340+ cities intercepts user requests before they reach your origin, apply security rules, serve cached content, and optionally execute lightweight compute at the edge. Cloudflare has added backend building blocks as well: D1 is a generally available SQLite-based database, Containers and Sandboxes have been generally available since 13 April 2026 with instances up to 4 vCPU and 12 GiB of memory (Cloudflare changelog), and Workers AI runs model inference at the edge. AWS still leads on Kubernetes orchestration, ML training and SageMaker depth, and large managed relational databases.

Evaluation Methodology

Prices, plan limits and quotas in this article come from the official Cloudflare and AWS pricing and documentation pages, last checked on 4 October 2026. Performance figures come from vendor pages and third-party benchmarks; where a figure is a vendor claim or could not be traced to its original source, the text says so. Cloud pricing changes frequently, so verify against the official pages before budgeting.

Edge vs. Full-Stack Cloud

Think of the internet as a city. AWS is the office building where your team works-it has conference rooms (databases), server rooms (EC2), and a mail center (S3). Cloudflare is the security checkpoint at the city gates. Every visitor gets screened, cached content gets handed out without disturbing the office, and bad actors never reach the building in the first place.

This is why the question “Cloudflare vs AWS” is subtly wrong. A more useful framing: “Where should my Cloudflare layer end and my AWS layer begin?” The answer determines your performance ceiling, your security posture, and-critically-how large your monthly bill becomes.

The Edge-First Stack is the architectural pattern that emerges from this framing. Route all user-facing traffic through Cloudflare (CDN, WAF, edge caching, DDoS mitigation), and reserve AWS for backend-only workloads that users never reach directly (RDS queries, S3 batch processing, EC2 application servers). This split delivers the performance of an edge network with the ecosystem depth of AWS-without forcing you to choose between them.

Market Adoption Context

AWS leads the backend cloud market with about 28% share in Q2 2026, and AWS (28%), Microsoft (20%) and Google (15%) together took about 63% of a $143.4 billion quarterly market for cloud infrastructure services (Synergy Research Group). Cloudflare is not measured the same way, because its product is a different layer. W3Techs reports Cloudflare as the reverse proxy of 28.0% of all websites (W3Techs, checked 26 October 2026), which makes it the most widely used edge layer in front of any backend.

Many production deployments run both. A company might run its application servers on EC2, store user uploads in S3, and use Cloudflare for CDN, WAF, and DNS, with Cloudflare R2 for assets that generate heavy egress. That pattern is common among teams that have looked closely at their bills.

Where Each Platform Fits

CDN Speed and Delivery

Cloudflare’s Anycast network spans 340+ cities. I could not verify third-party TTFB benchmark figures against the original data, so they are not charted here; see the note below.

Content delivery is where Cloudflare and AWS most directly overlap-and where the performance gap between them is most clearly documented. Both platforms serve as CDNs, but they approach the problem differently. For latency-sensitive applications, optimizing Core Web Vitals often starts at this edge layer.

AWS CloudFront, Amazon’s content delivery network, integrates tightly with the AWS ecosystem. If your origin is an EC2 instance, an S3 bucket, or an ALB, CloudFront requires zero additional configuration to connect. That tight coupling is its core advantage: zero internal transfer costs between AWS services, and native integration with Lambda@Edge for request manipulation. AWS lists 750+ CloudFront points of presence in 100+ cities across 50+ countries, plus 1,140+ embedded points of presence inside ISP networks across 300+ cities (AWS).

Cloudflare’s CDN sits across 340+ cities and uses Anycast routing to direct every request to the nearest healthy server. It is provider-agnostic: your origin can be on AWS, GCP, Azure, or a colocated rack. Cloudflare’s own comparison page claims better performance than CloudFront and credits Argo Smart Routing with a 30% improvement on dynamic traffic (Cloudflare). Both are vendor claims.

Global Network Size

Independent data points to a more nuanced picture than either vendor’s marketing suggests. Cloudflare is present in 340+ cities. CloudFront lists more points of presence in total, and its 1,140+ embedded locations sit inside ISP networks, closest to viewers. Cloudflare’s Anycast architecture also means a failing server is absorbed at the routing layer without manual failover configuration.

For applications serving global audiences from non-AWS or mixed origins, Cloudflare is usually the simpler choice. For applications running entirely inside AWS with traffic concentrated near AWS regions, CloudFront reduces architectural complexity.

TTFB & Latency Benchmarks

We do not quote average TTFB figures here, because the third-party benchmarks we found could not be traced back to their original test data.

In specific regions, CloudFront can win. A Cloudflare network performance update reported CloudFront at 107ms versus Cloudflare at 113ms in India, and some US ISPs, including AS4181 and AS22773, showed CloudFront ahead by 7-11% at p95. Real-world performance is geographically uneven, so measure from where your users are.

Cache hit ratio depends mostly on your cache rules and content, not on the vendor. Both platforms offer layered caching that consolidates misses before they reach the origin: Cloudflare through Tiered Caching, CloudFront through its 15 Regional Edge Caches.

DNS: Cloudflare vs Route 53

Two different things get mixed up here. 1.1.1.1 is Cloudflare’s public resolver, which users or networks choose for lookups. It says nothing about where your own domain’s records are hosted. For your domain, the comparison is authoritative DNS: Cloudflare DNS, which is included on every plan including Free, versus Amazon Route 53, which charges $0.50 per hosted zone per month for the first 25 zones and $0.50-0.75 per month per basic health check (AWS Route 53 pricing). Independent speed rankings for authoritative providers are published on DNSPerf and change over time, so check the current chart instead of relying on a fixed number.

Route 53 earns its place when you need weighted, latency-based or geolocation routing and failover tied to AWS health checks. For everything else, Cloudflare DNS is the simpler and cheaper choice.

Advanced Routing Products

For latency-sensitive dynamic traffic that cannot be cached, both platforms offer smart routing products:

• Cloudflare Smart Shield + Argo Smart Routing sends dynamic requests over Cloudflare’s private backbone instead of the public internet. Cloudflare cites a 30% performance improvement (Cloudflare). It is a paid add-on listed from $5/month on the plans page; check the dashboard for current usage-based charges.
• AWS Global Accelerator uses AWS’s private global network to accelerate TCP/UDP traffic to AWS-hosted endpoints. It works well for non-HTTP workloads (gaming, IoT, VoIP) and applications that need static anycast IP addresses.

The practical rule: Smart Shield + Argo Smart Routing is better for HTTP/HTTPS traffic with global users. Global Accelerator is better for non-HTTP protocols or when you need deterministic static IPs at the network level.

Cloudflare vs CloudFront

CloudFront suits origins inside AWS: data transfer from AWS origins to CloudFront is free, and private S3 and VPC origins work natively. Cloudflare suits mixed or non-AWS origins and teams that want WAF, DDoS protection and DNS in one plan, including a free one. On paper the entry prices are close: CloudFront Pro costs $15 per month, Cloudflare Pro $20 per month with annual billing.

People searching for “Cloudflare vs CloudFront” usually want one of two answers: which CDN costs less, or whether CloudFront can be dropped. The tables below use list prices from the official pages, checked on 4 October 2026.

CloudFront flat-rate plans vs Cloudflare plans

AWS added flat-rate CloudFront plans that bundle CDN, WAF, DDoS protection, Route 53 DNS, TLS certificate, logging, serverless edge compute and monthly S3 storage credits into one price with no overage charges (AWS CloudFront pricing). Cloudflare’s plans cover a similar bundle (Cloudflare plans).

Sources: AWS and Cloudflare, checked 4 October 2026. CloudFront prices are per distribution. The plans differ in features beyond this table, so compare the full feature lists before you choose.

CloudFront pay-as-you-go

CloudFront still offers usage-based pricing. List rates for the US and Europe (AWS pay-as-you-go pricing):

• The first 1 TB of data transfer out and the first 10 million requests per month are free.
• Data transfer out costs $0.085/GB for the next 9 TB and $0.080/GB for the next 40 TB.
• HTTPS requests cost $0.0100 per 10,000 in the US and $0.0120 in Europe.
• Data transfer from any AWS origin (S3, EC2, load balancers) to CloudFront is free.
• CloudFront Functions cost $0.10 per million invocations after 2 million free ones; Lambda@Edge costs $0.60 per million requests plus duration.

At 10 TB per month, this model lands in the high hundreds of dollars before request fees, which is why the $15 Pro flat-rate plan is the cheaper AWS route for many sites. Check the usage allowances on the AWS page before relying on that.

Where each one fits

CloudFront fits when:

• Your origin is S3, an ALB or another AWS service and you want the free origin-to-CDN transfer.
• You need private origins: the Business and Premium plans list private origins within a VPC.
• You already use Lambda@Edge or CloudFront Functions.
• You want one vendor, one bill and one IAM model.

Cloudflare fits when:

• Your origins sit on several clouds or on your own hardware.
• You want WAF and DDoS protection on a free or low-cost plan. Unmetered DDoS protection is included on every Cloudflare plan.
• You want DNS, CDN, WAF, Workers and R2 managed in one place.
• Your bill is dominated by egress that you can move to R2.

Using both in a chain adds a second cache layer and a second place to debug. There is one case where it can make sense: keeping CloudFront for a specific private S3 distribution while Cloudflare handles everything else. Otherwise, pick one CDN per application.

Speed differences are covered in the CDN section above. Both vendors publish their own benchmark claims, so test your own traffic before you let performance decide.

Security, WAF & DDoS Protection

Cloudflare’s unmetered DDoS protection is included on all plans including free; AWS Shield Advanced requires a $3,000/month minimum with an annual commitment - the starkest pricing gap in this entire comparison.

Security is where the pricing models diverge most between Cloudflare and AWS, and where the wrong choice can either leave you exposed or overpaying.

Cloudflare was built as a security product first. The WAF, DDoS mitigation, and bot management are deeply integrated into the same global network that handles CDN traffic-which means security rules execute at the edge with near-zero latency overhead. AWS security products (Shield, WAF, GuardDuty) are powerful but were added to an existing compute platform, and each requires separate configuration, separate billing, and integration work between services.

Web Application Firewall (WAF)

Cloudflare WAF ships with a managed ruleset covering OWASP Top 10 threats, zero-day protections updated automatically as Cloudflare discovers attacks across its global network, and a visual rule editor that lets teams write custom rules without deep security expertise. The Free plan includes the Free Managed Ruleset. The Pro plan adds the Cloudflare Managed Ruleset and the OWASP Core Ruleset (Cloudflare WAF docs), at $20/month billed annually or $25/month billed monthly.

AWS WAF charges $5 per web ACL per month, $1 per rule per month, and $0.60 per million requests (AWS WAF pricing). AWS’s own example: a web ACL with 19 rules and 10 million requests per month costs $30. AWS WAF integrates with CloudFront, ALB, API Gateway, and AppSync. AWS Managed Rules groups are maintained by AWS, and managed rule groups from AWS Marketplace sellers are billed on top (AWS’s example: $20/month plus $1.20 per million requests).

The setup model differs. Cloudflare’s managed rulesets are enabled per zone. AWS WAF is attached per resource (CloudFront distribution, ALB, API Gateway) and billed per web ACL, rule and request. Tuning false positives is work on both platforms. AWS’s per-rule pricing makes every added rule a line item, whereas Cloudflare’s plan price stays flat.

DDoS Protection Models

This is the starkest pricing comparison in the entire Cloudflare vs. AWS landscape:

• Cloudflare: Unmetered DDoS mitigation (L3/L4/L7) is included in all plans, including free. There is no volume cap, no per-Gbps charge, and no separate DDoS product to enable.
• AWS Shield Standard: Free, automatic protection against common L3/L4 attacks for AWS resources. Adequate for small-scale attacks.
• AWS Shield Advanced: $3,000/month with a 1-year subscription commitment, plus data transfer out usage fees (from $0.025/GB for CloudFront). Includes the L7 DDoS managed rule group, DDoS cost protection and, with Business or Enterprise Support, access to the Shield Response Team (AWS Shield pricing).
• CloudFront flat-rate plans: The $200/month Business plan lists advanced DDoS protection and the $1,000/month Premium plan includes it as well (AWS). That is a separate product from Shield Advanced.

Shield Advanced adds up to a $36,000 annual commitment. For startups and mid-market teams, Cloudflare’s unmetered DDoS protection on the Free or $20/month Pro plan costs far less than that. If your traffic can sit behind CloudFront, AWS’s own flat-rate plans are the cheaper AWS option. Shield Advanced is for large AWS-committed organizations that need L7 mitigation integrated with CloudFront and ALB, the response team and cost protection.

Bot & API Protection

Both platforms offer managed bot protection, with different packaging.

Cloudflare has three tiers. Bot Fight Mode is free. Super Bot Fight Mode is included in Pro, Business and Enterprise plans. Bot Management, which assigns every request a bot score from 1 to 99, is a paid Enterprise add-on (Cloudflare bots docs). Cloudflare says its detection draws on traffic across its whole network.

AWS WAF Bot Control provides similar managed bot rules as an add-on at $10/month per WebACL, plus request-based fees: the Common tier charges $1 per million requests (first 10 million free), the Targeted tier $10 per million requests (first 1 million free). It integrates with CloudFront and ALB but lacks the breadth of Cloudflare’s global threat intelligence network.

For API-heavy architectures, the full API Shield subscription (schema learning, schema validation and more) is an Enterprise add-on, but mTLS is not Enterprise-only, and Free, Pro and Business plans get a limited set of API Shield features (Cloudflare docs). On AWS you assemble comparable controls from WAF, API Gateway and Cognito.

Serverless Edge Compute

Cloudflare Workers uses V8 isolates, the engine that powers Chrome, and is built to avoid cold starts. AWS Lambda’s container model introduces cold starts that vary by runtime and package size, and the INIT phase has been billed since August 2025.

Serverless compute is where the architectural gap between Cloudflare and AWS is most technically interesting-and where a misunderstanding of the underlying execution model can cause serious production headaches. Whether you are running a monolithic backend or a decoupled webhook vs API architecture, choosing the right execution model fundamentally dictates performance.

Both platforms let you run code without managing servers. But “serverless” conceals a fundamental architectural difference that directly affects latency, cost, and use-case fit.

V8 Isolates vs. Containers

AWS Lambda executes functions inside lightweight containers (microVMs built on Firecracker). When a function is invoked, Lambda either reuses a warm container or spins up a new one. Spinning up a new container-a “cold start”-means initializing the language runtime, loading dependencies, and bootstrapping the execution environment. This delay is an inherent byproduct of the container lifecycle.

Cloudflare Workers uses a completely different model: V8 JavaScript isolates, the same technology that runs JavaScript inside Chrome. Isolates are not containers-they are in-process execution contexts that share a single V8 process but are isolated by memory boundaries. Spinning up an isolate takes microseconds, not hundreds of milliseconds, because there is no container initialization, no OS-level process creation, and no separate runtime to bootstrap.

The practical consequence: Cloudflare designs Workers to avoid cold starts. Lambda cold starts cannot be fully eliminated without moving to a persistent container model (which defeats the purpose of serverless), though provisioned concurrency can pre-warm containers at additional cost.

Cold Start Latency Gap

Community benchmarks put the gap in this range:

The Lambda figures are community benchmark ranges, not AWS guarantees. They vary with memory size, package size and runtime, and we could not trace them to a single original source on 4 October 2026, so treat them as orders of magnitude and measure your own function.

Lambda cold starts reach 500-2,000ms or more for Java and C# in these benchmarks, a noticeable delay for user-facing endpoints. A billing change adds a cost angle: since August 1, 2025, AWS bills the Lambda INIT phase for on-demand invocations of ZIP-packaged functions on managed runtimes, where initialization was previously unbilled (AWS Compute Blog). Cold starts therefore became a cost item as well as a latency item. For a 512 MB function with a 2-second initialization, the INIT phase is billed in GB-seconds like regular execution. AWS expects most accounts to see minimal impact, because initialization happens in a small share of invocations.

AWS reports that fewer than 1% of Lambda invocations experience cold starts under normal, sustained-traffic conditions. Cold-start rates climb for bursty traffic patterns, though. If your workload has irregular traffic, such as overnight cron jobs, event-driven webhooks or low-traffic microservices, more of your invocations pay for initialization.

Lambda Web Functions (October 2026)

On 12 October 2026, AWS announced Lambda Web Functions, a variant aimed at web apps (AWS News Blog). They bill active CPU time plus the memory held, so time spent waiting on I/O is not billed, and one environment can serve up to 128 concurrent requests. At launch they support only Node.js 24 and run in five regions, including Europe (Ireland). AWS says cold starts drop “by orders of magnitude”; that is a vendor claim, and there are no independent benchmarks yet. Classic Lambda functions, which AWS now calls event functions, keep the duration billing described above, including time spent waiting.

Edge Execution Compared

Both platforms offer edge compute-functions that run at geographically distributed PoPs, close to users rather than in a single central region.

Lambda@Edge runs Lambda functions at CloudFront PoPs. It supports Node.js and Python, and can manipulate HTTP requests and responses at four CloudFront event types (viewer request, origin request, viewer response, origin response). The catch: Lambda@Edge has tighter limits than regional Lambda. Viewer events allow a 5-second timeout and 128 MB, origin events a 30-second timeout (AWS CloudFront quotas), and it does not support all Lambda features (no VPC access, no environment variables, no layers, no arm64).

Cloudflare Workers runs globally by default across all 340+ edge locations. No configuration required. Workers supports JavaScript, TypeScript, Rust (via WebAssembly), and Python (generally available since 21 September 2026). The execution model (V8 isolates) is what lets Cloudflare avoid cold starts regardless of traffic pattern or geography. Workers integrates natively with Cloudflare’s D1 (SQLite-at-the-edge), KV storage, R2 object storage, and Durable Objects for stateful coordination.

For edge-native logic such as personalization, A/B testing, request routing and authentication at the edge, Workers is simpler to operate than Lambda@Edge, because deployment is global by default and there is no cold-start handling to design around.

Languages & Runtime Limits

Sources: Workers limits, Workers pricing, Lambda quotas, Lambda pricing, checked 4 October 2026. Workers bills CPU time, not wall-clock time, and requests for static assets are free and unlimited. Classic Lambda (event functions) bills duration, which includes time spent waiting on network calls. Lambda Web Functions bill active CPU time plus held memory instead.

Lambda’s language breadth and memory ceiling make it the right choice for compute-intensive workloads-video transcoding, ML inference, large data processing, and long-running jobs. While Lambda offers superior raw compute power for heavy workloads, Workers is undeniably the better engine for latency-sensitive edge routing.

Pricing and Egress Fees

Cloudflare R2 charges $0 for data egress versus S3’s $0.09/GB in the first pricing tier - roughly $900/month at 10 TB, with the gap growing as volume grows.

Pricing is where many teams discover that their AWS bill has grown more than expected, and where Cloudflare’s model creates its most concrete advantage. If you are comparing backend ecosystems, for example a Supabase Firebase alternative, include data transfer fees in your estimate.

The core asymmetry: AWS charges for data leaving the platform (egress). Cloudflare was built from the beginning on a model where egress is free. This one decision matters more as data volumes grow.

Egress Fees: R2 vs S3

Cloudflare R2, Cloudflare’s object storage product, was explicitly designed as a response to AWS’s egress pricing model. R2 charges:

• Storage: $0.015/GB per month
• Egress (data out): $0.00-zero, always, regardless of volume
• Class A operations (PUT/DELETE): $4.50 per million
• Class B operations (GET): $0.36 per million (free tier: 10M/month)

AWS S3 Standard charges:

• Storage: $0.023/GB per month
• Egress (data out): $0.09/GB for the first 10 TB/month after a 100 GB monthly free allowance (declining for higher volumes)
• PUT requests: $0.005 per 1,000
• GET requests: $0.0004 per 1,000

The egress difference compounds rapidly at scale:

*Our arithmetic from list prices: 1 TB = 1,024 GB, minus the 100 GB free allowance that AWS applies account-wide across all services, times $0.09. AWS charges lower per-GB rates in higher tiers (the tiers are 10 TB, next 40 TB, next 100 TB and above 150 TB), so the 100 TB and 1 PB rows are upper bounds. Use the AWS Pricing Calculator for exact figures.

For a media-heavy application that serves 10 TB of video or image content per month straight from S3, the egress line is roughly $900/month, or about $11,000/year, while R2 charges $0 for egress (Cloudflare R2 pricing, AWS S3 pricing). R2 offers an S3-compatible API, so many applications only need an endpoint and credentials change, but not every S3 feature exists in R2, so check the features you rely on.

Two caveats. First, request prices rarely tip the math: R2 Standard charges $4.50 per million Class A and $0.36 per million Class B operations, slightly below S3 Standard at $5.00 per million PUT and $0.40 per million GET. R2’s Infrequent Access tier costs more per operation ($9.00 and $0.90 per million) and adds a $0.01/GB retrieval fee. Second, data moving from S3 to CloudFront is free, so if your assets already sit behind CloudFront, the egress you pay is CloudFront’s, not S3’s. Run the numbers for your own setup before migrating.

Flat-Rate vs Pay-as-You-Go

The billing model difference goes beyond storage pricing.

Cloudflare sells website plans at flat monthly prices: Free ($0), Pro ($20/month billed annually or $25 monthly), Business ($200/month billed annually or $250 monthly) and Contract (custom). CDN, DNS, WAF and unmetered DDoS protection come with those plans (Cloudflare plans). The developer platform is billed separately by usage: Workers Paid has a $5/month minimum, and overages cost $0.30 per million requests and $0.02 per million CPU milliseconds. R2, KV and other storage products are usage-based as well.

AWS uses pay-as-you-go pricing for most services. EC2 per hour, Lambda per millisecond, S3 per GB plus per request plus per transfer, WAF per rule plus per request, Shield Advanced per month plus data transfer. The exception is CloudFront, which now also offers flat-rate plans at $0, $15, $200 and $1,000 per month with no overage charges. For everything else this model scales well for enterprises with dedicated cloud finance teams, but it produces bill shock for teams without FinOps discipline.

The practical difference for engineering teams:

For teams that want predictable infrastructure costs, Cloudflare’s flat-rate model is a significant operational advantage. For teams with large, predictable workloads and dedicated FinOps resources, AWS’s reserved instance pricing and Savings Plans can produce better unit economics at scale.

Load Balancing and DDoS Pricing (2026)

Two line items raise the most pricing questions, so here are the current numbers (checked on 4 October 2026).

Cloudflare Load Balancing pricing works as an add-on: it is listed from $5/month on the plans page, covering local and global traffic load balancing, geographic routing, health checks and failover. According to Cloudflare’s launch post, the base subscription includes 500,000 DNS queries to load-balanced hostnames per month, with each additional 500,000 queries billed at $0.50 (Cloudflare); that post is older, so confirm current allowances in the dashboard. Health checks probe status codes, response text and timeouts from Cloudflare’s network.

AWS load balancing is metered instead of flat: an Application Load Balancer bills $0.0225/hour (about $16.40/month base, us-east-1) plus $0.008 per LCU-hour that scales with connections, bandwidth and rule evaluations. AWS’s own pricing example lands at $22.42/month, so the real cost is workload-dependent and rarely under $20 (AWS ELB pricing). Route 53 health checks add $0.50/month per AWS endpoint and $0.75/month per external endpoint (up to 50 health checks for AWS endpoints are free; optional features like HTTPS probing or fast intervals cost $1-2/month extra per check) (AWS Route 53 pricing).

DDoS protection pricing shows the biggest gap, as long as you compare like with like:

The practical takeaway: for public-facing traffic, Cloudflare’s $0-5/month covers what AWS prices from $16/month for a load balancer up to $3,000+/month for Shield Advanced. Within AWS, a CloudFront flat-rate plan is the cheaper protection route. Shield Advanced mainly makes sense for resources that must stay directly exposed without a CDN in front.

Edge-First Stack Blueprint

A common production architecture for teams that use both is not “Cloudflare OR AWS” but the Edge-First Stack: Cloudflare at the network edge, AWS at the backend. The section on running Cloudflare in front of AWS below covers the setup, the trade-offs and the failure modes.

A note on what we run ourselves: alloq.digital is a statically built site deployed to Cloudflare Workers - static assets at the edge plus a small middleware layer for redirects - and every push to the main branch triggers a Workers build. Ad landing pages are edge-cached with a five-minute freshness window and stale-while-revalidate via _headers, so a deploy shows up within minutes while repeat loads stay warm. There is no AWS tier behind this particular site, which is exactly the point: for a content and lead-generation site, the edge layer alone carries the workload. The pattern below is what we reach for once a real backend enters the picture.

Here is what that architecture looks like in practice:

Traffic Layer (Cloudflare):

• DNS managed by Cloudflare (included on every plan)
• CDN caches static assets at 340+ edge locations
• WAF + DDoS mitigation applied before requests reach AWS
• Cloudflare Workers handles authentication, A/B testing, request routing at the edge
• Cloudflare R2 stores and serves high-egress assets (images, video, static files)

Backend Layer (AWS):

• EC2 or ECS/EKS runs application servers-only receiving requests that passed Cloudflare’s security layer
• RDS/Aurora manages relational data
• Lambda handles async background jobs and event-driven processing next to other AWS services
• S3 used for internal-only data (backups, ML training data, compliance archives)-egress charges only apply if this data exits AWS

For egress-heavy workloads, moving public assets from S3 to R2 is often the biggest single cost lever. Cache hits served by Cloudflare also never reach your origin, which cuts both origin load and AWS data transfer. Cache misses are different: traffic from S3, EC2 or an ALB to Cloudflare is billed as normal data transfer out, because AWS waives that charge only for CloudFront. The details are in the next sections.

The Edge-First Stack routes all user-facing traffic through Cloudflare’s edge layer (DNS, CDN, WAF, Workers, R2) before any request reaches the AWS backend (EC2, RDS, Lambda, S3) - eliminating most egress costs while maximizing global performance.

Cloudflare in Front of AWS: Architecture, Pros and Cons

Cloudflare in front of AWS means your DNS points to Cloudflare, which proxies requests to an origin on AWS such as an ALB or EC2 instance. Cloudflare’s WAF, DDoS protection and cache then sit before AWS. The trade-off: AWS waives data transfer to CloudFront but bills traffic leaving AWS toward Cloudflare as normal data transfer out, and you must lock the origin down to Cloudflare.

This is the “Cloudflare with AWS” or “Cloudflare on AWS” setup that many teams search for. It is a different decision from replacing CloudFront, and it only pays off if you handle the points below.

How the setup works

1. Proxy the DNS records through Cloudflare. Visitors then receive a Cloudflare IP address instead of your origin’s IP (Cloudflare docs).
2. Use Full (strict) encryption between Cloudflare and the origin, with a certificate the origin presents: an ACM certificate on the load balancer or a Cloudflare Origin CA certificate (Cloudflare SSL modes).
3. Lock the origin down. Your origin will see Cloudflare’s IP addresses, not visitor IPs. Cloudflare recommends allowing only Cloudflare’s ranges (and trusted partners) and blocking all other traffic, because anyone who finds the origin IP could otherwise bypass Cloudflare. Authenticated Origin Pulls (mTLS) add a certificate check, and Cloudflare Tunnel connects an origin without a publicly routable IP.
4. Set cache rules for what Cloudflare should cache, and pass the visitor IP to your application from the header Cloudflare adds, since the connecting IP is always a Cloudflare address.
5. Keep AWS-side routing in check. Cloudflare’s docs describe a case where a VPC route covering a 172.x range (for Transit Gateway or VPN) captures Cloudflare’s 172.64.0.0/13 traffic before it reaches the Internet Gateway and causes 521 or 522 errors. A more specific route to the Internet Gateway fixes it.

What you gain

• WAF and DDoS protection before AWS. Cloudflare’s unmetered DDoS protection is on every plan, and the Pro plan adds managed WAF rulesets. AWS’s own WAF example (19 rules, 10M requests) costs $30/month, plus Shield Advanced if you need more than Shield Standard.
• One edge for several origins. You can front origins in different AWS regions, accounts or other providers from a single Cloudflare zone.
• Fewer requests reaching AWS. Cache hits and blocked requests never touch your ALB, EC2 instances or S3 bucket.
• A path to cheaper egress. Public assets can move to R2 with $0 egress, and Workers can run lightweight logic at the edge while heavy compute stays in AWS.
• Operating experience. alloq.digital itself runs on Cloudflare Workers with static assets at the edge. There is no AWS tier behind this site, so we cannot claim savings numbers for a mixed setup from our own bill.

What you lose or have to handle

• Free origin-to-CDN transfer. AWS does not charge for data transfer from AWS origins to CloudFront. Traffic from AWS to Cloudflare is billed as standard data transfer out ($0.09/GB in the first tier after the 100 GB free allowance). A high cache hit ratio and R2 for large assets reduce this cost.
• Private origins. CloudFront can reach private S3 buckets and VPC origins natively. With Cloudflare, the origin must be publicly reachable or connected through Tunnel.
• Timeouts. Cloudflare waits 125 seconds for an origin response by default before returning a 524 error, and only Enterprise zones can change it (Cloudflare connection limits). Long-running requests need an asynchronous design.
• Upload size. The maximum request body is 100 MB on Free and Pro and 200 MB on Business (Workers limits).
• Two vendors. You manage two control planes, two bills and two places to debug.
• Latency on uncacheable requests. Users far from your AWS region still pay the round trip for dynamic requests. Smart Shield + Argo Smart Routing can help, as a paid add-on.

When it is worth it

It is worth it when you need a WAF and DDoS layer for public traffic, serve users worldwide, or have egress-heavy assets you can move to R2. Stay AWS-native when your origins are private, your traffic is mostly AWS-to-AWS, or one vendor and one audit surface matter more than the savings. A CloudFront flat-rate plan is then the first thing to price.

Head-to-Head Comparison

The following table covers the primary feature dimensions relevant to teams evaluating this decision. Pricing reflects the official pages as checked on 4 October 2026. Verify before budgeting.

Verdict & Recommendations

The short answer: most production teams should use both platforms. But the specific resource allocation between them will ultimately depend on your workload profile, team size, and overarching cloud bill tolerance.

Decision Matrix

When to Choose Which

Choose Cloudflare if:

• Your primary concern is global CDN performance, WAF, or DDoS protection on any budget
• You are serving high volumes of user-facing content and S3 egress fees are visible in your bill
• You are building edge-native compute (personalization, auth, A/B tests, routing) where cold starts are unacceptable
• You want predictable flat-rate pricing without per-request metering complexity (CloudFront flat-rate plans are the closest AWS equivalent)

Choose AWS if:

• You need large managed relational or NoSQL databases, Kubernetes orchestration, or ML training infrastructure such as SageMaker
• Your background jobs need more than Cloudflare Containers’ 12 GiB of memory or Workers’ 5 minutes of CPU time, or run close to other AWS services
• You are already deeply integrated into the AWS ecosystem and CloudFront’s native integration reduces architectural complexity (free AWS-origin transfer, private S3 and VPC origins)
• Your team has dedicated FinOps resources to manage precise cloud cost scaling

FAQ

Is Cloudflare cheaper than AWS?

Usually for CDN, WAF and DDoS protection, and for egress-heavy storage, but not in every case. Cloudflare’s Free plan includes unmetered DDoS protection, and R2 has no egress fees, while S3 charges $0.09/GB. AWS narrowed the gap with CloudFront flat-rate plans from $0 to $1,000 per month. For heavy compute, large relational databases and ML training, AWS has the deeper offering, while Cloudflare’s D1, Containers and Workers AI cover smaller workloads.

Is Cloudflare cheaper than CloudFront?

It depends on the plan. CloudFront’s Pro flat-rate plan costs $15 per month with 50 TB of transfer, against $20 per month (billed annually) for Cloudflare Pro. Pay-as-you-go CloudFront charges $0.085/GB after the first free TB. Cloudflare’s plans list no per-GB CDN fee. For AWS origins, CloudFront also waives origin transfer, which Cloudflare cannot.

Can I put Cloudflare in front of an AWS ALB or EC2 instance?

Yes. Proxy the DNS record through Cloudflare, set SSL mode to Full (strict), and allow only Cloudflare’s IP ranges in the security group. Your application then sees Cloudflare addresses instead of visitor IPs, so read the visitor IP from the header Cloudflare adds. Requests that take longer than 125 seconds return a 524 error.

Does Cloudflare in front of AWS reduce my AWS bill?

Partly. Cache hits and blocked attacks never reach your origin, which saves compute and requests. But AWS bills data transfer from your origin to Cloudflare as normal egress, unlike transfer to CloudFront. The largest savings come from moving public assets to R2, which charges no egress, and from replacing paid AWS WAF and Shield products.

Is Cloudflare DNS better than Route 53?

For most sites, Cloudflare DNS is simpler and cheaper: it is included on every Cloudflare plan, while Route 53 charges $0.50 per hosted zone per month plus health check fees. Route 53 is better when you need weighted, latency-based or geolocation routing and failover tied to AWS health checks across several regions.

How does Cloudflare Workers pricing compare with AWS Lambda?

Workers Free includes 100,000 requests per day. Workers Paid costs at least $5 per month with 10 million requests and 30 million CPU milliseconds included, then $0.30 per million requests and $0.02 per million CPU milliseconds. Lambda includes 1 million requests and 400,000 GB-seconds per month, then $0.20 per million requests plus duration charges.

What does Cloudflare Load Balancing cost?

The Load Balancing add-on is listed from $5 per month on Cloudflare’s plans page. Cloudflare’s launch post mentions 500,000 DNS queries included and $0.50 per additional 500,000, so confirm current allowances in the dashboard. An AWS Application Load Balancer costs $0.0225 per hour plus LCU charges, about $22 per month in AWS’s own example.

Does Cloudflare run on AWS?

No. Cloudflare operates its own global Anycast network with proprietary hardware in 340+ cities - it does not run on AWS or any other public cloud. That independence is exactly why the two combine so well: Cloudflare sits in front as the edge layer while AWS hosts your backend, and neither depends on the other’s infrastructure.

Can I combine Cloudflare and AWS?

Yes. Many teams run the Edge-First Stack: Cloudflare at the perimeter for DNS, caching, WAF rules and DDoS mitigation, and AWS behind it for compute, relational databases and machine learning. Check the trade-offs first: origin transfer to Cloudflare is billed, the origin needs locking down, and private S3 or VPC origins are easier with CloudFront.

Does Cloudflare replace CloudFront?

For most public websites, yes. Cloudflare covers the same delivery function and works with any origin. CloudFront remains the better fit for private S3 buckets, VPC origins and free transfer from AWS origins, and you rarely need both CDNs in front of one application.

AWS WAF vs Cloudflare WAF differences

Cloudflare WAF is built into its edge network. The Free plan includes the Free Managed Ruleset, and Pro adds the Cloudflare Managed and OWASP rulesets at a flat plan price. AWS WAF is attached per resource and billed at $5 per web ACL, $1 per rule and $0.60 per million requests, with AWS Managed Rules groups available; it is also included in CloudFront flat-rate plans.

Do I need AWS Shield with Cloudflare?

Not Shield Advanced, if all public traffic goes through Cloudflare first. Cloudflare provides unmetered L3, L4 and L7 DDoS mitigation on every plan, including Free. Paying $3,000 per month for Shield Advanced would duplicate it, unless you have AWS resources exposed directly to the internet that bypass Cloudflare. Shield Standard stays on for AWS resources at no extra cost.

Conclusion

The cloud infrastructure market has matured past the point where choosing a single vendor for every architectural layer makes operational or financial sense. AWS undeniably dominates the heavy lifting of backend compute, persistent storage, and complex container orchestration. Conversely, Cloudflare provides a dense global network, flat-rate security plans, and an edge execution environment built on V8 isolates.

The Edge-First Stack bridges this gap. By pushing security, caching, and serverless routing to Cloudflare’s edge while reserving AWS for protected backend databases and heavy compute, teams get the strengths of both ecosystems. You cut S3 egress fees by moving public assets to R2, block malicious traffic before it touches your AWS load balancers, and serve cached assets from the edge.

For more actionable insights on optimizing your cloud infrastructure and adopting modern application architectures, explore our SaaS developers guide to start building smarter today.

Building on the Edge-First Stack?

Designing an architecture that spans Cloudflare’s edge and an AWS backend is where most teams lose weeks. alloq.digital designs and ships production SaaS on exactly this stack - Workers and caching at the edge, typed APIs in between, AWS reserved for heavy compute and persistent storage. See our SaaS development services for how we scope and build it.

Talk to Simon about your architecture →