Amazon CloudFront in 2026: From CDN to Programmable Edge Platform
A practical look at how CloudFront has grown beyond a CDN — VPC Origins, CloudFront Functions, smarter image transformation, and flexible flat-rate pricing.
Estudante de Licenciatura
Amazon CloudFront in 2026: From CDN to Programmable Edge Platform
For years, Amazon CloudFront was mostly known as "the CDN that sits in front of S3." That description hasn't been accurate for a while — CloudFront has quietly grown into a full edge computing platform, with programmable logic, flexible pricing, and deep integrations across the AWS ecosystem. This article walks through what CloudFront actually does today and the updates that matter most if you're building or maintaining a distribution in 2026.
What CloudFront is, in one paragraph
CloudFront is AWS's global content delivery network: hundreds of edge locations (Points of Presence) around the world that cache and serve content close to your users, cutting latency and offloading traffic from your origin. But "content delivery" barely scratches the surface anymore — CloudFront now runs custom code at the edge, transforms images on the fly, fronts private VPC resources, and bundles security features that used to require separate services.
Flexible origins: not just S3 anymore
CloudFront can pull content from a wide range of origin types: Amazon S3 (including private buckets protected by Origin Access Control), VPC Origins for Application Load Balancers, Network Load Balancers, and EC2 instances in private subnets without a public IP, AWS Elemental MediaPackage and MediaStore for streaming workloads, Lambda Function URLs, and any custom HTTP/HTTPS origin. VPC Origins recently added support for WebSocket traffic as well, which matters if you're running real-time apps behind CloudFront.
Each origin can also belong to an origin group, giving you automatic failover between a primary and secondary origin — the foundation for multi-region active-active or active-passive architectures without extra tooling.
CloudFront Functions: real edge logic
CloudFront Functions let you run lightweight JavaScript directly at the edge for things like URL rewrites, header manipulation, and request routing, with sub-millisecond execution times. Two updates worth knowing about:
- Richer request context: Functions can now access edge location and Regional Edge Cache metadata (including the three-letter airport code of the serving edge location), retrieve raw query strings, and apply advanced origin overrides — useful for geo-specific routing or compliance requirements like directing EU traffic to GDPR-compliant origins.
- Custom logging: Functions can now write custom data directly into CloudFront access logs via a new
cf.logCustomData()helper, instead of only emitting to a separate CloudWatch Logs stream. That means you can log things like A/B test variant assignments or authentication outcomes right alongside the standard access log entry for that request — no more correlating two logging systems by hand.
Dynamic Image Transformation gets smarter
CloudFront's Dynamic Image Transformation (DIT) feature recently picked up four notable improvements:
- Enhanced smart cropping, combining multiple detection methods — faces, labels, text, logos, and custom Amazon Rekognition models — in a single request, with composition controls that preserve important elements like products, text, and logos when cropping.
- Better automatic optimization, using a tiered detection approach that layers CloudFront's device classification headers and configurable fallbacks behind Client Hints. This closes the browser-support gap that previously left roughly 30% of traffic served unoptimized, extending right-sized image delivery to every device type — phones, tablets, and smart TVs alike.
- An interactive transformation playground for testing policies before deploying them, showing metrics like output dimensions, format, file size, compression ratio, and processing time.
- Full feature parity between DIT's ECS and Lambda architectures, so the deployment model you choose no longer limits which features you can use.
If your app serves a lot of user-generated or catalog images, this is one of the more immediately useful updates — it removes a chunk of the custom resizing logic teams used to build themselves.
Pricing: flat-rate plans matured a lot
CloudFront's pricing story has changed noticeably. Beyond the original pay-as-you-go model, flat-rate plans now bundle content delivery, AWS WAF, DDoS protection, Route 53 DNS, logging, and edge compute under one predictable monthly price, with no overage charges even during traffic spikes.
Two changes stand out:
- Configurable Premium plan usage levels: instead of a single fixed allowance, the Premium flat-rate plan now offers self-service usage tiers ranging from 500 million to 6 billion requests and 50 TB to 600 TB per month, selectable directly in the console with instant pricing and no commitment required. That opens flat-rate pricing to mid-sized businesses whose baseline traffic previously priced them out.
- API-managed plans: flat-rate pricing plans can now be managed through the CloudFront API, CLI, SDKs, CloudFormation, and the CDK — meaning plan selection and changes can be baked directly into infrastructure-as-code and automated workflows instead of being a manual console task.
Flat-rate plans have also picked up support for Lambda@Edge, CAPTCHA, and mutual TLS, narrowing the gap with pay-as-you-go. They still don't cover real-time logs, dedicated IP SSL, or field-level encryption, so high-compliance or highly customized workloads may still need the traditional pricing model.
What this means in practice
If you need to... | CloudFront now offers |
|---|---|
Serve private ALB/NLB/EC2 resources without a public IP | VPC Origins (including WebSocket support) |
Run custom routing/security logic at the edge | CloudFront Functions with richer context and native logging |
Resize and optimize images on the fly | Dynamic Image Transformation, now with smart cropping and a testing playground |
Get predictable monthly costs at scale | Configurable flat-rate Premium plans, manageable via API/IaC |
Build multi-region failover | Origin groups with automatic failover |
A note on regional availability
Not every feature is uniformly available everywhere. Dynamic Image Transformation, for instance, is available in all commercial regions plus four opt-in regions: Asia Pacific (Hong Kong), Middle East (Bahrain), Africa (Cape Town), and Europe (Milan). If you operate in China, also note that AWS will discontinue CloudFront support in the AWS China (Ningxia) region on May 31, 2027, decommissioning all four Points of Presence there, with no new customers accepted after September 30, 2026. Always check the specific feature's regional availability page before designing around it.
Final thoughts
CloudFront's evolution over the past couple of years tells a clear story: AWS is positioning it less as "a CDN with some extra features" and more as a general-purpose edge platform that happens to also cache your content. If you haven't looked at CloudFront Functions, VPC Origins, or the new flat-rate plan options recently, it's worth another look — there's a good chance some of the custom infrastructure your team built around CloudFront's older limitations can now be replaced with a native feature.
This article is based on the latest AWS updates published as of September 2026. For official and up-to-date information, check the AWS What's New page .
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article