The cdn.provider.<id> health check returned UNKNOWN ("CDN provider does not
support connection tests") for any adapter without CdnOperations, i.e. the
NONE placeholder and Souin. The central evaluator never alerts or changes
state on UNKNOWN, so such a check is permanently useless.
- New optional SPI CdnHealthProbe/CdnHealth; the health check prefers it,
then the connection test, then reports UP with testable=false.
- CloudFront implements it: GetDistribution -> UP when enabled and
Deployed, DEGRADED while InProgress, DOWN when NoSuchDistribution or
disabled; throttling/5xx/network errors DEGRADED; rejected or missing
credentials DOWN. On AccessDenied it falls back to GetDistributionConfig
(the kof22 policy grants that, not GetDistribution) and reports
testable=false; if both are denied, UP with testable=false.
- CloudWatch AWS/CloudFront 5xxErrorRate (Average, 5-min periods, last 30
minutes) goes into details; above 5% the check is DEGRADED. Best effort.
- Messages are fixed text; details hold only booleans, numbers and known
states.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5
9ff55f4c23