Overview
Use Cloudflare at the edge and AWS behind it: they overlap on DNS, CDN, WAF, object storage, and serverless functions, but only AWS offers managed relational databases, a VPC network, and the broad service catalog. Prices below are list prices checked on 2026-10-01; AWS also now sells CloudFront as flat-rate plans.
Comparison
| Dimension | Cloudflare | AWS |
|---|---|---|
| DNS | Authoritative DNS included with every plan | Route 53: 0.40 per million queries |
| CDN pricing | Plan-based (Free, Pro, Business, Enterprise) | CloudFront pay-as-you-go, or flat-rate plans: Free 15, Business 1,000 per month; no overage charges; bundle WAF, DDoS protection, Route 53 DNS, TLS, and edge compute |
| DDoS | Included in the network | Shield Standard included; Shield Advanced $3,000 per month with a one-year term, plus data transfer fees |
| Object storage | R2: $0.015 per GB-month, egress free | S3 Standard: 0.09 per GB after 100 GB free per month |
| Serverless | Workers: $5 per month minimum; 10M requests and 30M CPU-ms included | Lambda: $0.20 per million requests plus GB-seconds |
| Databases | D1 (SQLite), Vectorize, Durable Object storage; Hyperdrive and partners for external Postgres or MySQL; no Cloudflare-managed Postgres in its docs | RDS, Aurora, DynamoDB, ElastiCache, Redshift, Aurora DSQL |
| Private networking | Tunnel, Zero Trust, no VPC | VPC, PrivateLink, Transit Gateway, Direct Connect |
| Compliance | FedRAMP High achieved by Cloudflare for Government on 2026-08-10 (FedRAMP Moderate since 2022); DoD IL4 being pursued | Most extensive: FedRAMP High and DoD IL4 and IL5 in GovCloud, HIPAA-eligible services under a BAA, many services in scope |
| Network | 348 cities | Regions and Availability Zones, plus CloudFront edge |
Pick Cloudflare when
Pick Cloudflare for the front door and for egress-heavy delivery.
- DNS, CDN, WAF, and DDoS in front of any origin, including AWS. See cloudflare.
- Media, downloads, and APIs that serve lots of data: R2 removes egress charges. Compare with CloudFront flat-rate plans for CDN-only needs.
- Short, latency-sensitive edge logic on Workers (personalization, geo routing, A/B tests); see cloudflare-workers-vs-aws-lambda.
- Globally replicated key-value (KV) and strongly consistent stateful actors (Durable Objects) at the edge, which have no AWS equivalent in every location.
- Containers driven from Workers (Cloudflare Containers is generally available on the Workers Paid plan) for workloads outside the isolate limits.
Pick AWS when
Pick AWS behind the edge for stateful and regulated workloads.
- Managed relational and NoSQL databases; see aurora-vs-rds-postgres and dynamodb-vs-postgres.
- VPC isolation, PrivateLink, and on-premises connectivity.
- Cross-service IAM: service control policies, permission boundaries, and resource policies have no Cloudflare equivalent (Cloudflare uses scoped API tokens).
- Container orchestration: ECS and EKS are general-purpose orchestrators; Cloudflare Containers is driven from Workers.
- ML, analytics, and event services (Bedrock, SageMaker, Athena, Kinesis).
- Regulated workloads: check each service’s authorization in AWS compliance documentation for your Region. Cloudflare’s FedRAMP High covers Cloudflare for Government, not every Cloudflare product, so check scope before relying on it.
Combine
For a new SaaS, put Workers, R2, and KV at the edge and Aurora or RDS behind them. Cloudflare complements AWS compute that needs managed databases, queues, or VPC isolation; it does not replace it.
Migrate
Move edge layers first; they are low risk.
- Route 53 to Cloudflare DNS: export the zone, import it, lower TTLs, then change registrar nameservers and keep the old zone until caches expire.
- S3 to R2: use R2’s migration tooling or
rclone, switch clients to the S3-compatible endpoint, and test signed URLs and CORS. - Lambda to Workers: rewrite handlers; see the linked comparison. Databases and VPC-bound services stay on AWS.
- Consider CloudFront flat-rate plans before moving a CDN if you are otherwise happy on AWS.
FAQ
Can Cloudflare replace AWS entirely?
No for most stateful products; Cloudflare has no managed Postgres in its docs and no VPC. Put Cloudflare at the edge and keep managed databases, private networking, and regulated workloads on AWS.
Is R2 cheaper than S3?
R2 lists 0.023 per GB-month for S3 Standard plus $0.09 per GB egress after 100 GB free per month (list prices checked on 2026-10-01). The gap is largest for egress-heavy media, downloads, and APIs.
Is Cloudflare FedRAMP authorized?
Cloudflare for Government achieved FedRAMP High on 2026-08-10, but that covers Cloudflare for Government, not every Cloudflare product. AWS offers FedRAMP High and DoD IL4 and IL5 in GovCloud, so check each service’s scope.