AzureAzure Front DoorNetworking

`azurerm_cdn_frontdoor_profile` cost estimation

Global CDN + WAF + load balancer. Standard at $35/month base + $0.17/GB outbound. Premium at $165/month base + $0.225/GB outbound. WAF rules and Private Link add fees. Anycast routing across 192+ POPs.

Azure Front Door is the global edge platform combining CDN, WAF, load balancing, and DDoS protection. The azurerm_cdn_frontdoor_profile creates the profile; endpoints, origins, routes, and rules are configured separately. Two main tiers: Standard and Premium.

Standard tier ($35/month base + usage): - Outbound data transfer: $0.17/GB for first 50 TB - Inbound data transfer: free - Routing: $0.17/GB - WAF managed rule sets: $0.60 per rule per month - Custom domains: 5 included, $0.50/month each additional - SLA: 99.99%

Premium tier ($165/month base + usage): - Outbound: $0.225/GB for first 50 TB - Private Link integration: included - Managed bot protection: included - WAF advanced rule sets: included - Higher rate limits per second - SLA: 99.99%

WAF custom rules: $1.00 per rule per month WAF managed rules: $0.60 per rule per month (Standard), included in Premium DDoS protection: free; advanced features in Premium

A typical website serving 500 GB/month with WAF (10 managed rules): - Standard base: $35 - Outbound: 500 × $0.17 = $85 - WAF rules: 10 × $0.60 = $6 - Total: $126/month

Front Door vs Azure CDN: Front Door is the strategic platform; Azure CDN (Microsoft, Verizon, Akamai variants) is retiring. New deployments should use Front Door.

c3x estimates Front Door based on sku_name and (via c3x-usage.yml) expected outbound data transfer and rule counts.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_cdn_frontdoor_profile" "main" {
  name                = "prod-front-door"
  resource_group_name = azurerm_resource_group.main.name
  sku_name            = "Standard_AzureFrontDoor"

  tags = {
    Environment = "production"
  }
}

resource "azurerm_cdn_frontdoor_endpoint" "main" {
  name                     = "prod-endpoint"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
}

Pricing dimensions

What you actually pay for when you provision azurerm_cdn_frontdoor_profile.

Dimension	Unit	What's being charged
Standard base fee	per month	Monthly base fee for Standard tier. Required regardless of traffic. $35/month
Premium base fee	per month	Premium tier base. Includes managed bot, advanced WAF, Private Link. $165/month
Outbound data transfer (Standard)	per GB	Data egress through Front Door. Tiered pricing reduces rate at higher volumes. $0.17/GB first 50 TB, $0.14/GB next 100 TB
Outbound data transfer (Premium)	per GB	Premium outbound rate, slightly higher than Standard. $0.225/GB first 50 TB
WAF managed rules (Standard)	per rule per month	Pre-built rule sets like OWASP Top 10. Included in Premium. $0.60 per rule-month
WAF custom rules	per rule per month	Custom WAF rules you define. Same rate for Standard and Premium. $1.00 per rule-month

Optimization tips

Common ways to reduce azurerm_cdn_frontdoor_profile cost without changing the workload.

Cache aggressively at the edge

50-95% on origin egress

Front Door's CDN caches responses. Properly configured TTLs reduce origin requests (and origin data transfer). A 95% cache hit rate cuts origin egress to 5% of total, proportional savings on origin compute and transfer.

Compress responses

60-80% on text content

Enable compression in Front Door rules. Gzip/Brotli compression reduces bytes transferred 60-80% for HTML/JSON/CSS/JS. Direct savings on $0.17/GB egress.

Skip Premium if Private Link/bot protection not needed

$130/month

Premium is $130/month more than Standard for features many workloads don't need. Compare your specific requirements (Private Link to origin, advanced bot protection, managed rule premium) against the cost.

Audit unused WAF rules

WAF rules accumulate over time. Each managed rule = $0.60/month. A workload with 50 inherited rules = $30/month in rule costs. Audit and disable rules that don't apply to your application.

Use Standard for SaaS Edge requirements

Most SaaS workloads (HTTPS termination, basic WAF, global CDN) work fine on Standard. Premium's incremental features (Private Link, bot manager, advanced WAF) are for specific compliance/security needs.

FAQ

Is Front Door cheaper than CloudFront for similar traffic?

Roughly comparable. CloudFront first-tier egress is $0.085/GB; Front Door Standard is $0.17/GB. CloudFront has 1 TB free monthly; Front Door has no free tier but cheaper at very high volumes. For 5 TB+/month, the comparison gets closer to neutral. Front Door's integrated WAF is a feature, not a free add-on.

Should I use Front Door for static sites?

For low-traffic personal sites, the $35/month base may be more than the site warrants. Use Azure Storage with static website hosting + Azure CDN classic (cheaper for very low volume) or CloudFlare's free tier. Front Door pays off when you have moderate traffic + WAF needs.

Does Front Door replace Application Gateway?

Partially. Front Door is global (multi-region routing); Application Gateway is regional. For multi-region failover and global routing, Front Door. For single-region L7 routing with VNet integration, AppGW. Many architectures use Front Door for ingress + AppGW behind for regional routing.

How does Front Door pricing scale beyond 50 TB?

Tiered rates decrease. After 50 TB outbound at $0.17/GB, the next 100 TB is $0.14/GB, then $0.115, $0.09, $0.08 for over 5 PB. For high-volume content delivery, the effective rate drops considerably.