AWS Builder Center

Builder Center

Protect Your Lightsail Web Apps from Cost Spikes with CloudFront Flat-Rate Pricing Plans

Amazon Lightsail offers predictable flat-cost hosting, but traffic spikes from viral content, DDoS attacks, or bot crawlers can cause costly data transfer overages. By adding a CloudFront flat-rate pricing plan, you get a single predictable monthly price that bundles CDN acceleration, WAF, and DDoS protection—with no overage charges. This post walks you through setting up CloudFront flat-rate pricing plans to protect your Lightsail web applications with end-to-end cost certainty.

Lana

Introduction 

Researchers and developers hosting web applications on Amazon Lightsail choose the service for its predictable flat-cost pricing, seamless AWS integration, and simplified management. However, unexpected traffic spikes from DDoS attacks, viral content, AI bot crawlers, and automated scrapers can lead to substantial data transfer overage charges, undermining Lightsail's cost predictability. 
In November 2025, AWS introduced flat-rate pricing plans for Amazon CloudFront  that eliminate overage charges during traffic spikes. These plans also bundle essential services—CDN, WAF and DDoS protection, DNS, TLS certificates, and more—into predictable monthly pricing. 
In this post, I'll show you how to configure CloudFront flat-rate pricing plans to protect your Lightsail-hosted web applications. This solution is particularly valuable for researchers operating on grant-funded budgets, educational institutions with fixed IT budgets, and small businesses that need cost certainty for their web applications. 

What are the CloudFront Flat-Rate Pricing Plans? 

CloudFront flat-rate pricing plans offer a simple monthly price with complete cost predictability. Unlike traditional pay-as-you-go pricing, these plans eliminate overage charges regardless of traffic volume. 
Key benefits include: 
  • Global content delivery 
  • AWS WAF and DDoS protection 
  • Bot management 
  • Amazon Route 53 DNS 
  • Amazon CloudWatch Logs ingestion 
  • Serverless edge compute 
  • Monthly Amazon S3 storage credits 
Plans are available in Free ($0/month), Pro ($15/month), Business ($200/month), and Premium ($1,000/month) tiers, with no annual commitment required. For a detailed comparison of what each plan includes, see the CloudFront flat-rate pricing plans  page. 

Benefits of CloudFront Flat-Rate Pricing for Lightsail 

By combining Lightsail with CloudFront flat-rate pricing plans, you gain five key benefits that protect your budget, enhance security, and optimize performance: 
  • ​​Budget Certainty for Grant-Funded Research​: Whether your research papers are published, datasets go viral, or applications receive media coverage, costs remain constant regardless of traffic volume. This protects grant budgets and eliminates emergency funding requests when research gains unexpected popularity. 
  • ​​WAF and DDoS Protection at No Additional Cost​: CloudFront's included WAF and DDoS protection absorb malicious traffic before it reaches your infrastructure. These security features filter threats at the edge, protecting your Lightsail instance from attacks—all bundled into your flat-rate plan without extra charges. 
  • ​​S3 Storage Offset​: CloudFront flat-rate pricing plans include S3 storage credits that offset storage costs for large datasets, media files, and application assets, reducing overall AWS spending while maintaining CloudFront's global edge network performance. 
  • ​​Origin Load Reduction​: CloudFront reduces requests to your Lightsail instance by serving cached content from locations closer to users. This improves response times globally and allows you to use smaller, more cost-effective Lightsail instances since your origin handles a fraction of total traffic. 
  • ​​Free Data Transfer from AWS Origins: With CloudFront, there are no additional data transfer charges from AWS origins like Lightsail, S3, or EC2 to CloudFront edge locations.​ This enables you to build sophisticated research platforms combining multiple AWS services without worrying about inter-service transfer costs. 

Steps to Set Up CloudFront Flat-Rate Pricing for Lightsail 

This section walks you through subscribing to a CloudFront flat-rate pricing plan and creating a distribution that fronts your Lightsail instance. 

Prerequisites 

  • A running Lightsail instance with a static IP attached 
  • A web application accessible via HTTPS on the instance 
  • A registered domain name (e.g., research.example.org) currently pointing to your Lightsail static IP 
  • A new dedicated origin hostname (e.g., research-origin.example.org) with an A record pointing to your Lightsail static IP and a valid TLS certificate configured on your web server. 
  • Access to your DNS provider to create and modify records 

Step 1: Subscribe to a Flat-Rate Pricing Plan 

Open the Amazon CloudFront console and choose Create distribution and select a flat-rate pricing plan that matches your traffic and security needs. 

Step 2: Configure the Distribution 

Configure the distribution to point to your dedicated origin hostname: 
  • Under Origin type, select Other and enter your dedicated origin hostname (e.g., research-origin.example.org) as the custom origin. 
  • For Viewer protocol policy, select Redirect HTTP to HTTPS. 
  • Under Alternate domain name (CNAME), enter your public domain (e.g., research.example.org). 
  • For TLS certificate, request or select an ACM certificate that covers your public domain (e.g., research.example.org).
  • Under Default cache behavior, set the cache policy to CachingOptimized for static content, or CachingDisabled if your application serves dynamic, personalized pages. 
  • Set the Origin request policy to AllViewer to forward query strings and headers your application needs. 

Step 3: Configure Security Settings 

CloudFront flat-rate pricing plans include AWS WAF at no additional cost. When creating your distribution, you can enable one-click security protections that activate the following core protections: 
  • Amazon IP Reputation List — Blocks requests from IP addresses identified as threats by Amazon internal threat intelligence. 
  • Core Rule Set — Protects against OWASP Top 10 vulnerabilities including SQL injection and cross-site scripting (XSS). 
  • Known Bad Inputs — Blocks request patterns known to be malicious, preventing discovery of application vulnerabilities. 
Under the security section of the distribution configuration, review the available settings and adjust them based on your application's needs: 
  • Monitor mode — Starts WAF rules in log-only mode so you can observe traffic patterns and verify that legitimate requests pass before switching to active enforcement. Run in monitor mode for 1–2 weeks to establish a traffic baseline before switching to active enforcement. 
  • Rate limiting — Throttles excessive requests from individual IP addresses to protect your origin from request floods. Consider enabling this if your application is susceptible to volumetric abuse. 
Paid flat-rate pricing plans include access to additional AWS WAF managed rule groups and features such as bot control, advanced DDoS protection, and application-specific protections. For more details, see AWS Managed Rules rule groups list  in the WAF Developer Guide. 

Step 4: Create the Distribution and Update DNS 

Finalize the distribution and route traffic through CloudFront: 
  • Choose Create distribution and wait for the status to change to Deployed (approximately 5 minutes). 
  • In your DNS provider, replace the existing A record for the public domain name with a CNAME record (or Route 53 alias record) pointing to the CloudFront distribution domain name. 
Tip: Lower your DNS record’s TTL to 60–300 seconds a few hours before making this change. This ensures traffic shifts to CloudFront quickly and reduces the window where some users still reach your Lightsail instance directly. 

Step 5: Verify the Setup 

Confirm that traffic is flowing through CloudFront and your application works correctly: 
Check the response headers for X-Cache: Hit from cloudfront or X-Cache: Miss from cloudfront to confirm CloudFront is serving the request. 

Step 6: Add a Custom Header to Block Direct Origin Access 

To ensure all traffic flows through CloudFront and prevent attackers from bypassing your CDN and WAF protection, configure a shared secret between CloudFront and your origin: 
  • Open the CloudFront console and select your distribution. 
  • Go to the Origins tab, select your origin, and choose Edit. 
  • Under Add custom header, add: 
    • Header name: X-Origin-Verify 
    • Value: A unique, random secret. Store this value securely—you’ll need it for both the CloudFront header and your web server configuration. 
Choose Save changes and wait for the distribution to redeploy. 

Step 7: Configure Your Web Server to Require the Header 

Configure your web server to reject any request that does not include the secret header. On every incoming request, the web server checks for the X-Origin-Verify header and compares its value against the secret you configured in the previous step. If the header is missing or the value doesn’t match, the request is denied. 
If you are using a different blueprint or web server version, adapt the configuration to your environment. 

For the WordPress blueprint (version 7.0, Apache 2.4 on Debian 12 Bookworm): 

Create the configuration file (copy and paste the entire block): 
1
2
3
4
5
6
# /etc/apache2/conf-available/origin-verify.conf 
<Location "/"> 
  <If "req('X-Origin-Verify') != 'your-secret-value-here'"> 
    Require all denied 
  </If> 
</Location> 
Enable the configuration and restart Apache: 
1
2
sudo a2enconf origin-verify 
sudo systemctl restart apache2 

For the Nginx blueprint (version 1.30, Nginx on Debian 12 Bookworm): 

Add the following inside your server block (before any location blocks) in /etc/nginx/conf.d/default.conf: 
1
2
3
if ($http_x_origin_verify != "your-secret-value-here") { 
    return 403; 
} 
Reload Nginx:
1
2
sudo /usr/sbin/nginx -t 
sudo systemctl reload nginx 

Step 8: Verify Origin Protection 

Confirm that direct access to your origin is blocked: 
  • Access https://<YOUR_STATIC_IP> directly — it should return a 403 Forbidden response. 
  • Access https://<CLOUDFRONT_DOMAIN> — it should load your site normally. 
Tip: Rotate the secret value periodically by updating both the CloudFront custom header and your web server configuration simultaneously. 

Conclusion 

Unexpected traffic spikes—whether from DDoS attacks, viral content, AI bot crawlers, or automated scrapers—shouldn't derail your budget or disrupt your web applications. By pairing Amazon Lightsail with CloudFront flat-rate pricing plans, you get complete cost predictability, built-in WAF and DDoS protection, global performance optimization, and free data transfer from AWS origins—all without complex configurations or surprise charges. 
For researchers on grant-funded budgets, educational institutions, and small businesses that need cost certainty, this combination eliminates the risk of emergency funding requests when your work gains unexpected attention—your research can go viral without a single overage charge. 
As your application grows, you can layer additional protections such as bot control, geo-restrictions, and application-specific WAF rules—all within your flat-rate plan, with no billing surprises. 
To get started, explore the CloudFront flat-rate pricing plans  and choose the plan that fits your workload.
# amazon-cloudfront# amazon-lightsail# cost-optimization
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article