CloudFront monitoring with Topologix

Cloud & CDN

Per-distribution CDN health from CloudWatch’s AWS/CloudFront namespace — requests, bytes downloaded and uploaded, and 4xx / 5xx / total error rates over a selectable window — with the distribution picked from a list discovered in your account.

Requirements

  • An IAM access key that can call cloudfront:ListDistributions and cloudwatch:GetMetricData — the managed CloudFrontReadOnlyAccess + CloudWatchReadOnlyAccess policies work, or a custom policy with just those two actions.
  • At least one CloudFront distribution. CloudFront is global — its control-plane API always answers from us-east-1 (the fetcher pins it there), and its CloudWatch metrics carry the Region: Global dimension.

1 · Set up the integration

  1. Open the Integrations pageClick Integrations in the toolbar and pick CloudFront from the catalogue.
  2. Create a read-only IAM userAWS Console → IAM → Users → Create user, attach CloudFrontReadOnlyAccess + CloudWatchReadOnlyAccess, then Security credentials → Create access key (“Third-party service”).
  3. Enter the credentialsAccess Key ID, Secret Access Key, and the CloudWatch Region to read metrics from — us-east-1 is where CloudFront publishes them by default.
  4. Create, then verifyClick Create, then reopen the integration and click Test — it lists distributions and reports “Connected — N distribution(s)”. Invalid keys and a missing cloudfront:ListDistributions grant produce distinct, plain-language errors.
The integration catalogue — CloudFront found via search.
The integration catalogue — CloudFront found via search.
The CloudFront configuration drawer with example values. Every screen in this guide is the real product.
The CloudFront configuration drawer with example values. Every screen in this guide is the real product.
Target on a private network? Route it through a proxy agent. Proxy agents run inside your network — behind NAT, on a management VLAN, in an air-gapped segment — and reach targets the Topologix server can't. The agent polls the server every 15 seconds for its assignments, runs the checks locally, and pushes results back every 5 seconds, so no inbound firewall rules are ever needed. Set a default proxy on the integration; every metric source can override it. If a proxy goes offline, its sources are marked stale within ~90 seconds and the last known values stay visible.

2 · Add it to a flow

  1. Select the CDN nodeClick the node, open Metrics, then + Add and choose the CloudFront integration.
  2. Pick the distributionA dropdown of the account’s distributions by domain name (with the description comment when one is set) — or paste a distribution ID directly.
  3. SavePick the period (1 minute to 24 hours) and click Add Source. The card charts requests, transfer in both directions, and the three error rates.
Live canvas screenshots for this integration require a real CloudFront environment, so this guide shows the configuration screens only — the flow steps above work exactly like every other integration.

Good to know

  • All six series come back in a single GetMetricData call — Requests, BytesDownloaded, BytesUploaded as sums; 4xxErrorRate, 5xxErrorRate, TotalErrorRate as averages.
  • The error-rate metrics are percentages computed by CloudWatch, not counts — write alert thresholds in percent.

All integrations →

See it on your own infrastructure

Book a demo and we will walk you through Topologix with your systems in mind: on our cloud, or self-hosted in your own network.

Book a demoContact us