CloudFront distributions serving zero requests
What does ZopNight detect here?
A CloudFront distribution that has served zero requests in 30 days is almost always abandoned infrastructure. ZopNight reads the Requests metric over a 30-day window and reports the full distribution cost as recoverable, because a distribution serving nothing has no partial value to preserve.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-165 |
| Category | idle |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | cloudfront_idle.go |
The signal is deliberately simple
One metric, Requests, among those CloudFront sends to CloudWatch, over 30 days. Unlike a compute resource there is no ambiguity to resolve
here. A CDN either served traffic or it did not. There is no equivalent of “low CPU but real
work happening”, so the rule needs no corroborating axis.
The saving is reported at 100% of the distribution’s cost. That is not an estimate: a distribution nobody requests from has no partial utility to preserve, so removing it recovers the whole line.
Why these accumulate
Distributions outlive what they fronted. A marketing microsite gets retired, a staging environment is torn down, an old asset domain is replaced, and the distribution stays, because deleting one requires disabling it first and waiting for it to propagate. That two-step is enough friction that people skip it.
Reading the Requests metric in us-east-1
aws cloudwatch get-metric-statistics --namespace AWS/CloudFront --metric-name Requests --dimensions Name=DistributionId,Value=E1234567890ABC Name=Region,Value=Global --start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --period 86400 --statistics SumCloudFront metrics live in us-east-1 regardless of where your other resources are. That is a common
reason a manual check comes back empty and looks like confirmation.
Before deleting
Check whether the distribution still has a DNS record pointing at it. An alias record left behind after deletion produces a dead hostname rather than a clean removal, and if the domain is still public that is a subdomain takeover risk rather than a cost saving.
Disable the distribution first, confirm nothing breaks over a few days, then delete.
Price class is the other lever
If the distribution is used but lightly, the fix is usually not deletion but the price class. CloudFront defaults to serving from every edge location worldwide; restricting to North America and Europe cuts the per-request and per-GB rates materially for an audience that was never outside those regions. That is a change of one setting rather than a migration.