CloudFront is the CDN you end up on because the rest of your stack is already in AWS. That is its greatest strength and the thing most worth examining before you commit to it. Here is the technical and commercial comparison, including the part where AWS's newer pricing is genuinely hard to beat.
Two pricing models, and one of them changed the maths
CloudFront now sells both pay-as-you-go and flat-rate plans, and they behave very differently.
Pay-as-you-go
| CloudFront | CDNShark | |
|---|---|---|
| Free allowance | 1 TB transfer + 10M requests/month | 50 GB (Free plan) |
| Transfer out, NA/EU, first 10 TB | $0.085/GB | $0.02/GB (Basic), $0.01/GB (Enterprise) |
| HTTPS requests | $0.0100 per 10,000 (NA), $0.0120 (EU) | No request fees |
| Invalidations | Charged beyond the free monthly quota | Unlimited, no charge |
On pure pay-as-you-go, CDNShark is roughly four times cheaper per gigabyte and charges nothing per request. For a request-heavy API workload, the request line alone can exceed the bandwidth line on CloudFront.
Flat-rate plans
| Plan | Price | Included |
|---|---|---|
| Free | $0 | 1M requests, 100 GB transfer, 5 WAF rules, 5 GB S3 |
| Pro | $15/mo | 10M requests, 50 TB transfer, 25 WAF rules, 50 GB S3 |
| Business | $200/mo | 125M requests, 50 TB, 50 WAF rules, private VPC origins, 1 TB S3, uptime SLA |
| Premium | $1,000/mo | 500M requests, 50 TB, bot management, origin failover, 5 TB S3, SLA |
Figures as of August 2026 — verify on the AWS pricing page, as these plans are relatively new.
Be clear-eyed about this: at $15/month with 50 TB of included transfer and no overage charges, CloudFront's Pro plan is aggressive, and for a single high-traffic property it will beat CDNShark's metered pricing outright. The same 50 TB on CDNShark's Basic plan would be billed at $0.02/GB past the first 100 GB. If you have one big site and no objection to AWS, that plan is a strong offer and you should take it seriously.
Where the comparison turns is on account shape rather than volume. CDNShark's plans include domains — 10 on Basic, 100 on Enterprise — with certificates, DNS zones, pull zones, WAF modes, and tunnels across all of them, and no per-request meter.
Architecture: the mid-tier is the real difference
CloudFront has two layers of cache above your origin — regional edge caches, plus optional Origin Shield — so a cold object is fetched from your origin roughly once, not once per edge. CDNShark has no mid-tier. With 11 edges, a cold object can produce up to 11 origin fetches. Collapsed forwarding (proxy_cache_lock) means concurrent requests at the same edge produce one fetch, and stale content is served through origin errors, timeouts, and 5xx — but there is no cross-edge shielding. If your origin is fragile, size for that.
Edge compute and WAF
CloudFront gives you CloudFront Functions (lightweight JavaScript at the viewer boundary) and Lambda@Edge (full runtime at the origin boundary). CDNShark has no edge compute — its rules are declarative: cache TTL by extension or path prefix, 301 redirects, CORS policy, geo and IP allow/block, hotlink protection, four rate-limit modes.
On security, the flat-rate plans bundle a WAF rule allowance, which is a real improvement over paying for AWS WAF separately per rule and per request. CDNShark includes its WAF in basic and strict modes at no extra charge, plus:
- Rate limiting at 100 r/s per IP and 1000 r/s per hostname, with four per-site modes
- A platform-wide IP blacklist fed from threat feeds, enforced in Lua at the edge
- A proof-of-work JS challenge — 12 leading zero bits with a 30-minute clearance, or 16 bits with a 5-minute clearance under attack mode, on HTML navigations only, with stateless HMAC-signed clearance cookies bound to IP prefix and user-agent hash
It is a smaller ruleset than AWS WAF's managed rule groups. It is also not metered.
Lock-in, in both directions
CloudFront's integration is genuinely valuable: S3 origins with no egress charge to CloudFront, ACM certificates, IAM, Shield, CloudWatch. If your application already lives there, everything fits, and moving delivery elsewhere means paying AWS egress to reach your new CDN — the cost that keeps most people where they are.
CDNShark's answer is not "no lock-in," it is different origins:
- Garage S3-compatible storage in HDD, NVMe, and VOD tiers, with browser-direct presigned multipart upload and no egress charge to the CDN
- Private origin tunnels — reach an origin on a private network with no public IP, no port forward, no inbound rule, over connector-initiated WireGuard
- Any external origin, with per-record origin TLS mode
Limitations, stated plainly
- 11 edge PoPs versus CloudFront's several hundred. No South America, Africa, Japan, Korea, or Australia.
- No HTTP/3 or Brotli. Both negotiate
h2, but CloudFront also advertisesh3; CDNShark serves HTTP/2 with gzip. - No mid-tier or shield cache.
- No edge compute.
- No uptime SLA comparable to the CloudFront Business and Premium plans.
- DDoS capacity is not in the same class. AWS Shield Standard is included with CloudFront and backed by AWS's absorption capacity. CDNShark has rate limiting, blocklists, and a shield tier — useful, but not equivalent.
- Metered bandwidth with overages, where CloudFront's flat plans have none.
Who should pick which
CloudFront if your origin is in AWS, if you need Lambda@Edge, if you want an SLA, if you need shielding for a delicate origin, or if the $15 Pro plan's included transfer simply beats metered pricing for your volume. That last case is common and we are not going to pretend otherwise.
CDNShark if you are on pay-as-you-go and the per-request line has become annoying, if you run many domains and want certificates and DNS included rather than assembled, if your origin cannot be exposed to the internet, or if you want to avoid deepening AWS lock-in for the delivery layer specifically.