All cheat sheets
Networkingcheat sheet

CloudFront Security Savings Bundle

A self-service, console-buried discount: commit to a monthly CloudFront + WAF spend for one year and get up to 30% off — no account manager, no procurement, ten minutes of clicking. Size the commitment to your lowest month, not your average.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided CloudFront Security Savings Bundle walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Hidden low in the CloudFront console sidebar is a self-service committed-use discount: promise a monthly combined CloudFront + WAF spend for one year, get ~10–30% off those services (tier scales with the commitment). Overage bills at the discounted rate; underage still bills the full commitment — so size against your lowest month. For steady spenders it's ten minutes of clicking for four figures a year.

The numbers

  • Tiers (approximate): $100–999/month commit → ~10% off · $1k–9.99k → ~20% · $10k+ → up to 30%
  • $2,500/month combined spend committed at 20% → **$6,000/year saved** for spend you were making anyway
  • Covered: CloudFront data transfer + requests, WAF request and web-ACL fees. Not covered: Shield Advanced, Lambda@Edge compute time
  • Spiky-traffic example from the source workflow: a sports-season streamer committing at $1,200 (below their slowest month, ~12% tier) banked ~$5k/year and never overpaid — deliberately not maximizing the tier

Do this

  1. Chart 6–12 months of combined CloudFront + WAF spend in Cost Explorer. Don't sign anything before seeing the shape of the curve.

  2. Pick the commitment floor: steady spend → ~10% under your lowest month; seasonal/spiky → 70–80% of your lowest month. You can raise a commitment mid-term for a better tier; you can never lower it.

  3. Enroll: CloudFront console → "Savings Bundle" (tucked low in the sidebar) → review AWS's estimator → enter the commitment → confirm the 1-year term. Discount applies from the next bill — no ramp-up.

  4. Set a billing alarm at the commitment floor so a slow month warns you before you've quietly paid for unused commitment.

  5. Optimize usage first, then commit: cache-hit-ratio and compression work (this sheet) lowers the spend you're committing to — do it in that order, and the discounts compound.

Gotchas

  • One-year term, no early termination. The only real risk is over-committing; every month under the floor is money burned.
  • Up-only adjustments: growth lets you re-tier upward mid-term, but there's no path down.
  • Uncovered line items don't count toward the floor — a bill dominated by Shield Advanced or Lambda@Edge changes the math.
  • Three false beliefs keep people out: it is not enterprise-only (any account ≥ ~$100/month qualifies), it needs no account-manager approval, and it is not cancelable.

Skip this if

  • The workload is short-term (a 3–6 month campaign) or you may migrate off CloudFront/WAF within the year.
  • Spend is genuinely unpredictable with no reliable floor.
  • CloudFront alone runs $10k+/month — pursue Private Pricing first (deeper discounts; sometimes stackable) and use the bundle for the WAF remainder.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are sizing a CloudFront Security Savings Bundle commitment. Use
the AWS CLI / Cost Explorer READ-ONLY. Do not purchase or modify
anything — produce a sizing recommendation only.

1. Pull 6–12 months of combined CloudFront + WAF spend (Cost Explorer
   filtered to those services, monthly granularity). Covered items:
   CloudFront data transfer + request fees, WAF request/web-ACL fees.
   NOT covered (exclude from the commitment math): Shield Advanced,
   Lambda@Edge compute.
2. Characterize variability: lowest month, highest month, trend.
   Recommendation rule: steady spend → commit ~10% below the lowest
   month; spiky/seasonal → commit at 70–80% of the lowest month;
   migrating off CloudFront or short-term project → do not enroll.
3. Estimate savings at the recommended commitment using the tier
   shape (~10% at $100–999/mo, ~20% at $1k–9.99k, up to 30% at $10k+),
   and note overage is also discounted, so under-committing is cheap
   insurance while over-committing is a pure loss.
4. Flags: spend >$10k/mo on CloudFront alone → also pursue Private
   Pricing (can sometimes stack); usage-side optimizations (cache hit
   ratio, compression, price class) should land BEFORE sizing, since
   they lower the floor.

Output: the monthly history table, recommended commitment number with
reasoning, estimated annual savings, and a reminder to set a billing
alarm at the commitment floor. Do NOT enroll — the 1-year term has no
early termination.
Works with any assistant that can run shell commands.

Want the guided version?

The CloudFront Security Savings Bundle walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Networking cheat sheets

AWS Direct Connect

A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.

AWS PrivateLink

Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.

AWS WAF Rule Optimization

One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.

CloudFront Egress Discounts

Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.