cloudthinker-ai AWS CloudFront Skill
Analyze AWS CloudFront distributions with parallel execution and anti-hallucination guardrails.
Relationship to other AWS skills:
aws-cloudfront/→ CloudFront-specific analysis (distributions, caching, origins)aws/→ "How to execute" (parallel patterns, throttling, output format)
CRITICAL: Parallel Execution Requirement
ALL independent operations MUST run in parallel using background jobs (&) and wait.
#!/bin/bash
export AWS_PAGER=""
for dist_id in $distributions; do
get_distribution_details "$dist_id" &
done
wait
Helper Functions
#!/bin/bash
export AWS_PAGER=""
# List all distributions
list_distributions() {
aws cloudfront list-distributions \
--output text \
--query 'DistributionList.Items[].[Id,DomainName,Status,Enabled,Origins.Items[0].DomainName]'
}
# Get distribution details
get_distribution_config() {
local dist_id=$1
aws cloudfront get-distribution --id "$dist_id" \
--output text \
--query 'Distribution.[Id,DomainName,Status,DistributionConfig.Enabled,DistributionConfig.DefaultCacheBehavior.ViewerProtocolPolicy]'
}
# Get cache hit ratio metrics
get_cache_hit_ratio() {
local dist_id=$1 days=${2:-7}
local end_time start_time
end_time=$(date -u +"%Y-%m-%dT%H:%M:%S")
start_time=$(date -u -d "$days days ago" +"%Y-%m-%dT%H:%M:%S" 2>/dev/null || date -u -v-${days}d +"%Y-%m-%dT%H:%M:%S")
aws cloudwatch get-metric-statistics \
--namespace AWS/CloudFront --metric-name CacheHitRate \
--dimensions Name=DistributionId,Value="$dist_id" Name=Region,Value=Global \
--start-time "$start_time" --end-time "$end_time" \
--period $((days * 86400)) --statistics Average \
--output text --query 'Datapoints[0].Average'
}
# Get request count
get_request_count() {
local dist_id=$1 days=${2:-7}
local end_time start_time
end_time=$(date -u +"%Y-%m-%dT%H:%M:%S")
start_time=$(date -u -d "$days days ago" +"%Y-%m-%dT%H:%M:%S" 2>/dev/null || date -u -v-${days}d +"%Y-%m-%dT%H:%M:%S")
aws cloudwatch get-metric-statistics \
--namespace AWS/CloudFront --metric-name Requests \
--dimensions Name=DistributionId,Value="$dist_id" Name=Region,Value=Global \
--start-time "$start_time" --end-time "$end_time" \
--period $((days * 86400)) --statistics Sum \
--output text --query 'Datapoints[0].Sum'
}
# List recent invalidations
list_invalidations() {
local dist_id=$1
aws cloudfront list-invalidations --distribution-id "$dist_id" \
--max-items 10 \
--output text \
--query 'InvalidationList.Items[].[Id,CreateTime,Status]'
}
Common Operations
1. Distribution Inventory with Status
#!/bin/bash
export AWS_PAGER=""
aws cloudfront list-distributions \
--output text \
--query 'DistributionList.Items[].[Id,DomainName,Status,Enabled,HttpVersion,PriceClass,Origins.Quantity]'
2. Cache Performance Analysis
#!/bin/bash
export AWS_PAGER=""
DISTS=$(aws cloudfront list-distributions --output text --query 'DistributionList.Items[].Id')
END=$(date -u +"%Y-%m-%dT%H:%M:%S")
START=$(date -u -d "7 days ago" +"%Y-%m-%dT%H:%M:%S" 2>/dev/null || date -u -v-7d +"%Y-%m-%dT%H:%M:%S")
for dist in $DISTS; do
{
hit_rate=$(aws cloudwatch get-metric-statistics \
--namespace AWS/CloudFront --metric-name CacheHitRate \
--dimensions Name=DistributionId,Value="$dist" Name=Region,Value=Global \
--start-time "$START" --end-time "$END" \
--period 604800 --statistics Average \
--output text --query 'Datapoints[0].Average')
requests=$(aws cloudwatch get-metric-statistics \
--namespace AWS/CloudFront --metric-name Requests \
--dimensions Name=DistributionId,Value="$dist" Name=Region,Value=Global \
--start-time "$START" --end-time "$END" \
--period 604800 --statistics Sum \
--output text --query 'Datapoints[0].Sum')
printf "%s\tHitRate:%.1f%%\tRequests:%s\n" "$dist" "${hit_rate:-0}" "${requests:-0}"
} &
done
wait
3. Origin Health Check
#!/bin/bash
export AWS_PAGER=""
DISTS=$(aws cloudfront list-distributions --output text --query 'DistributionList.Items[].Id')
END=$(date -u +"%Y-%m-%dT%H:%M:%S")
START=$(date -u -d "1 day ago" +"%Y-%m-%dT%H:%M:%S" 2>/dev/null || date -u -v-1d +"%Y-%m-%dT%H:%M:%S")
for dist in $DISTS; do
{
errors4xx=$(aws cloudwatch get-metric-statistics \
--namespace AWS/CloudFront --metric-name 4xxErrorRate \
--dimensions Name=DistributionId,Value="$dist" Name=Region,Value=Global \
--start-time "$START" --end-time "$END" \
--period 86400 --statistics Average \
--output text --query 'Datapoints[0].Average')
errors5xx=$(aws cloudwatch get-metric-statistics \
--namespace AWS/CloudFront --metric-name 5xxErrorRate \
--dimensions Name=DistributionId,Value="$dist" Name=Region,Value=Global \
--start-time "$START" --end-time "$END" \
--period 86400 --statistics Average \
--output text --query 'Datapoints[0].Average')
printf "%s\t4xx:%.2f%%\t5xx:%.2f%%\n" "$dist" "${errors4xx:-0}" "${errors5xx:-0}"
} &
done
wait
4. SSL Certificate Expiry Check
#!/bin/bash
export AWS_PAGER=""
aws cloudfront list-distributions \
--output text \
--query 'DistributionList.Items[].[Id,DomainName,ViewerCertificate.CertificateSource,ViewerCertificate.Certificate]'
5. Invalidation History
#!/bin/bash
export AWS_PAGER=""
DISTS=$(aws cloudfront list-distributions --output text --query 'DistributionList.Items[].Id')
for dist in $DISTS; do
aws cloudfront list-invalidations --distribution-id "$dist" --max-items 5 \
--output text \
--query "InvalidationList.Items[].[\"$dist\",Id,CreateTime,Status]" &
done
wait
Anti-Hallucination Rules
- CloudFront metrics require Region=Global - CloudFront metrics use
Region=Globalas a dimension, not a specific AWS region. Omitting this returns no data. - Cache hit rate is a percentage - CacheHitRate is 0-100, not 0-1. Do not multiply by 100.
- Invalidation costs money - First 1000 paths/month are free, then $0.005/path. Do not create invalidations unnecessarily.
- Distribution deployment takes 15-20 min - Status "InProgress" is normal after changes. Do not report this as an error.
- Price class affects edge locations - PriceClass_All uses all edges. PriceClass_100/200 limits to cheaper regions. This affects latency.
Output Format
Present results as a structured report:
Aws Cloudfront Report
═════════════════════
Resources discovered: [count]
Resource Status Key Metric Issues
──────────────────────────────────────────────
[name] [ok/warn] [value] [findings]
Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]
Target ≤50 lines of output. Use tables for multi-resource comparisons.
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "I'll skip discovery and check known resources" | Always run Phase 1 discovery first | Resource names change, new resources appear — assumed names cause errors |
| "The user only asked for a quick check" | Follow the full discovery → analysis flow | Quick checks miss critical issues; structured analysis catches silent failures |
| "Default configuration is probably fine" | Audit configuration explicitly | Defaults often leave logging, security, and optimization features disabled |
| "Metrics aren't needed for this" | Always check relevant metrics when available | API/CLI responses show current state; metrics reveal trends and intermittent issues |
| "I don't have access to that" | Try the command and report the actual error | Assumed permission failures prevent useful investigation; actual errors are informative |
Common Pitfalls
- CloudFront API is us-east-1 only: All CloudFront API calls go to us-east-1 regardless of your configured region.
- Aliases vs DomainName: The
DomainNameis the CloudFront domain (d123.cloudfront.net). Custom domains are inAliases. - Behavior order matters: CloudFront matches behaviors by path pattern in order. The default (*) behavior is the fallback.
- CloudWatch statistics syntax: Use spaces not commas:
--statistics Average Maximum. - Real-time metrics: Standard CloudFront metrics have 1-minute granularity. Real-time metrics require additional configuration.