CloudWatch Metric Guide
Amazon CloudFront CloudWatch AlarmsThresholds, failures, and debugging guides
4 CloudWatch metrics covered for Amazon CloudFront. Each guide includes the recommended alarm threshold, common root causes, and how Nuberio automatically diagnoses it when it fires.
4
metrics covered
AWS/CloudFront
namespace
5 min
to run a free audit
Amazon CloudFront metrics
Requests
Requests counts the total number of viewer requests received by CloudFront for a distribution, across all HTTP methods and both HTTP and HTTPS. Per AWS documentation, CloudWatch reports this metric with Unit set to "None" rather than "Count."
Threshold
Anomaly detection recommended over a fixed threshold — alarm when Requests falls more than 50% below the expected baseline for the same time of day, sustained for 3 consecutive 5-minute periods
5xxErrorRate
5xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 5xx range, indicating a server-side error at the origin or within CloudFront itself.
Threshold
> 1% sustained for 3 consecutive 5-minute periods (Average statistic)
4xxErrorRate
4xxErrorRate is the percentage of all viewer requests for which CloudFront's response had an HTTP status code in the 4xx range, indicating a client-side or request-validation error such as a missing resource or a denied request.
Threshold
> 5% sustained for 3 consecutive 5-minute periods (Average statistic)
OriginLatency
OriginLatency measures the total time, in milliseconds, from when CloudFront receives a request to when it starts sending a response back toward the network — but only for requests served from the origin (a cache miss), not from CloudFront's cache. Also known as first-byte latency or time-to-first-byte.
Threshold
p90 > 1000 ms sustained for 3 consecutive 5-minute periods (ExtendedStatistics p90)
Audit your setup
Missing a Amazon CloudFront alarm?
The free Nuberio Audit scans your CloudWatch setup and flags missing or misconfigured Amazon CloudFront alarms in 5 minutes. No credit card. Read-only access.
Looking for alarms across other AWS services? View the full CloudWatch metric guide — thresholds and debugging guides for RDS, Lambda, ECS, ALB, EC2, and DynamoDB.