All cheat sheets
Networkingcheat sheet

CloudFront Private Pricing

AWS's worst-kept secret: at 10+ TB/month of CDN egress you can negotiate custom CloudFront rates — typically 20–40% below the public price list — but only if you ask. AWS will never bring it up first.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided CloudFront Private Pricing walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Above roughly 10 TB/month of CloudFront egress, you qualify for negotiated per-GB rates — typically $0.050–$0.065/GB against the ~$0.085 public list — in exchange for a 6–12 month volume commitment. There's no console button and AWS won't volunteer it; you open a support case or email your account manager and say the magic words. At 50 TB/month that's $12k–21k/year for one email.

The numbers

  • 50 TB/month: ~$4,250 list vs $2,500–$3,250 negotiated → $1,000–$1,750/month saved
  • Field examples from the source workflow: a fitness-video platform at 80 TB/month locked $0.055/GB and saves $32k/year; a game studio at 120 TB/month negotiated $0.050/GB with a 100 TB floor — $60k/year, with the biggest relief in expensive regions (Australia, Brazil)
  • A 35 TB/month SaaS below the informal threshold still got a deal based on growth trajectory — asking costs nothing

Do this

  1. Pull 3–6 months of egress history (Cost Explorer → CloudFront usage types). Consistent 10+ TB/month = qualified; if not, AWS will usually tell you the exact volume to hit — a useful milestone.

  2. Contact AWS and use the routing phrase: "CloudFront Private Pricing" or "CDN committed-use discounts" — via your account manager or a plain support case. Round trip is typically 2–4 weeks.

  3. Commit to your floor, not your average. You pay the committed volume even in slow months. Base it on your lowest realistic month; overage bills at the discounted rate anyway, so under-committing costs little.

  4. Negotiate the first offer. Reps are measured on commitment, not margin — a 15% opener often becomes 25%. Mention Cloudflare/Fastly/Akamai if you genuinely use or could use them; competitive pressure tightens offers.

  5. Ask for regional parity — discounted rates across all edge locations, not just NA/EU. If APAC or South America serves real traffic, this term can matter more than the headline rate.

Gotchas

  • The commitment is real: sign for 50 TB, use 30 TB, pay for 50 (at the discounted rate). Conservative sizing is the entire risk management.
  • It's a CloudFront-only deal — S3 egress and EC2 aren't touched; but the conversation is a natural opener for an EDP (Enterprise Discount Program) if your total AWS spend justifies one.
  • It can sometimes stack with the self-service Security Savings Bundle — ask explicitly.
  • If you're on Enterprise Support, your TAM should be driving this; an unused TAM is the priciest idle resource in AWS.

Skip this if

  • You're well under 10 TB/month with flat traffic — take the free win of the Security Savings Bundle instead and set a reminder for when volume grows.
  • Your usage is one spiky campaign, not a sustained baseline — commitments punish that shape.
  • You haven't optimized usage yet — fix cache hit ratio and compression first, then negotiate on the lower volume.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are preparing the data package for a CloudFront Private Pricing
negotiation. Use the AWS CLI with READ-ONLY credentials. Do not create,
modify, or delete anything — produce an evidence-based negotiation
brief only.

1. Volume history: Cost Explorer (if accessible) — CloudFront usage by
   usage type for the trailing 6 months: DataTransfer-Out GB per
   region class, request counts, monthly $ totals. Otherwise CloudWatch
   BytesDownloaded per distribution.
2. Qualification check: consistent ≥10 TB/month egress (the unofficial
   floor). Note trend (growing traffic strengthens the negotiating
   position) and seasonality (informs the safe commitment floor —
   recommend committing near the LOWEST realistic month, never the
   average).
3. Compute the ask: current blended $/GB vs target $0.050–$0.065/GB;
   annual savings at 20%, 30%, 40% discounts. Note which expensive
   regions (APAC, South America, India, Middle East) contribute
   materially — regional parity is a valuable deal term to request.
4. Adjacent programs to fold into the brief: CloudFront Security
   Savings Bundle (self-service, can sometimes stack) and EDP if
   overall AWS spend is large.

Output: a one-page negotiation brief — monthly volumes, trend,
proposed commitment floor, target rate, estimated savings range, and
the contact script ("We'd like to discuss CloudFront Private Pricing /
CDN committed-use discounts at our current volume"). Change nothing in
the account.
Works with any assistant that can run shell commands.

Want the guided version?

The CloudFront Private Pricing walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.