Skip to main content
idle · aws

CloudFront distributions serving zero requests

rule IDs covered
1
severity
medium

What does ZopNight detect here?

A CloudFront distribution that has served zero requests in 30 days is almost always abandoned infrastructure. ZopNight reads the Requests metric over a 30-day window and reports the full distribution cost as recoverable, because a distribution serving nothing has no partial value to preserve.

Signal and threshold

How ZopNight evaluates CloudFront distributions serving zero requests.
Field Value
Rule IDsRC-165
Categoryidle
Severitymedium
Metricnone — pure configuration read
Sourcecloudfront_idle.go

The signal is deliberately simple

One metric, Requests, among those CloudFront sends to CloudWatch, over 30 days. Unlike a compute resource there is no ambiguity to resolve here. A CDN either served traffic or it did not. There is no equivalent of “low CPU but real work happening”, so the rule needs no corroborating axis.

The saving is reported at 100% of the distribution’s cost. That is not an estimate: a distribution nobody requests from has no partial utility to preserve, so removing it recovers the whole line.

Why these accumulate

Distributions outlive what they fronted. A marketing microsite gets retired, a staging environment is torn down, an old asset domain is replaced, and the distribution stays, because deleting one requires disabling it first and waiting for it to propagate. That two-step is enough friction that people skip it.

Reading the Requests metric in us-east-1

Terminal window
aws cloudwatch get-metric-statistics --namespace AWS/CloudFront --metric-name Requests --dimensions Name=DistributionId,Value=E1234567890ABC Name=Region,Value=Global --start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --period 86400 --statistics Sum

CloudFront metrics live in us-east-1 regardless of where your other resources are. That is a common reason a manual check comes back empty and looks like confirmation.

Before deleting

Check whether the distribution still has a DNS record pointing at it. An alias record left behind after deletion produces a dead hostname rather than a clean removal, and if the domain is still public that is a subdomain takeover risk rather than a cost saving.

Disable the distribution first, confirm nothing breaks over a few days, then delete.

Price class is the other lever

If the distribution is used but lightly, the fix is usually not deletion but the price class. CloudFront defaults to serving from every edge location worldwide; restricting to North America and Europe cuts the per-request and per-GB rates materially for an audience that was never outside those regions. That is a change of one setting rather than a migration.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·