cloudfront:CreateMonitoringSubscription is a Write access-level action in the cloudfront service. Grants permission to enable additional CloudWatch metrics for the specified CloudFront distribution. The additional metrics incur an additional cost
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows cloudfront:CreateMonitoringSubscription. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCloudfrontCreateMonitoringSubscription",
"Effect": "Allow",
"Action": "cloudfront:CreateMonitoringSubscription",
"Resource": "*"
}
]
}