Amazon CloudWatch Internet Monitor: What It Is, Pricing ($0.01 per Resource-Hour and the City-Network Charge That Really Sets the Bill), Setup With CloudFront or a VPC, and Internet Monitor vs Network Synthetic Monitor, Flow Monitor and RUM

Amazon CloudWatch Internet Monitor shows how the internet between your users and your AWS application is behaving: which cities and which internet providers are seeing slow or failed connections to your CloudFront distribution, VPC, Network Load Balancer or WorkSpaces, and whether the problem is the provider or AWS. It uses measurements AWS already collects across its network, so there is nothing to install. Pricing is $0.01 per monitored resource per hour ($7.30 a month) plus $0.74 per 10,000 city-networks per hour after the first 100, plus CloudWatch Logs for its measurement logs (US East, October 2026). The surprise is which number sets the bill. For a 30-resource monitor watching 45,000 city-networks, the resources cost $216 a month and the city-networks about $2,392. Capping city-networks at 100 keeps a small site at about $7.30 a month.

Three customers of Jake's shop, all in the same town two hours away, emailed in one week to say the online store "kept spinning". Everyone else was fine, and Ethan's own tests from home were fast. "It's either their internet or ours," Jake said, "and I'd like to know which before I pay anyone to fix it." Ethan turned on Internet Monitor for the store's CloudFront distribution. Two days later it showed one regional internet provider in that town losing traffic every evening, and nothing wrong on the AWS side.

This guide explains Internet Monitor in plain English, what it costs with real numbers, how to set it up so it cannot surprise you on the bill, and how it differs from the other CloudWatch network monitoring tools with similar names. If CloudWatch itself is new to you, start with what CloudWatch is.

What CloudWatch Internet Monitor is, in plain English

Your application runs in AWS, and your users reach it across the public internet: their home or mobile connection, their internet provider, and several networks in between. When something goes wrong in that middle part, your own dashboards look perfect, because your servers are fine. You only hear about it as vague complaints from one region. Internet Monitor fills that gap. AWS constantly measures connectivity across its global network, and Internet Monitor applies those measurements to your traffic, showing performance and availability from each place your users connect from.

The unit it works in is the city-network: a city plus the network your users there come through, usually their internet provider, identified by its ASN (autonomous system number). "Lockport, provider X" is one city-network; the same city with a mobile carrier is another. For each city-network with traffic to your resources, Internet Monitor calculates a performance score and an availability score, the estimated share of traffic not seeing a drop, and raises a health event when they fall below a threshold, telling you whether the cause appears to be a specific provider or the AWS network.

It sits in the CloudWatch console under Network Monitoring, next to two other tools covered later: Network Synthetic Monitor and Network Flow Monitor. Nothing runs on your servers; you only tell it which resources carry your internet-facing traffic.

Jake: "So it's like a traffic report, but only for the roads to my shop."

Ethan: "Exactly. And it tells you which road has the pothole."

How Internet Monitor works: resources, scores and health events

• Resources you can monitor: VPCs (which must have an internet gateway), Network Load Balancers, CloudFront distributions and WorkSpaces directories. A single monitor holds one type of resource, so CloudFront distributions and VPCs go in separate monitors. A monitor can include resources from several Regions, but its data is stored only in the Region where you create the monitor.
• Traffic percentage: you choose what share of your application's traffic to monitor, 100% by default. Lower values cost less and see less.
• City-networks maximum: an optional cap on how many city-networks the monitor tracks. This is the main cost control.
• Health events: created when performance or availability scores drop below a threshold, 95% by default for both, for overall impact and for local impact. You can set your own thresholds.
• Outputs: the Internet Monitor dashboard, CloudWatch metrics for your traffic overall and per Region and edge location, measurement logs in CloudWatch Logs every five minutes for your top 500 city-networks, optional copies of the measurements in S3, and health events sent to Amazon EventBridge. If the AWS network itself causes a problem, you also get an AWS Health Dashboard notification.
• Suggestions: the dashboard can estimate how latency would change if you served users through a different Region or through CloudFront.

After you create a monitor, it needs 15 to 30 minutes to build a traffic profile of where your users are before the dashboard fills in. The internet weather map in the same console page, a global view of internet outages from the past 24 hours by city and provider, is free and works without any monitor at all.

CloudWatch Internet Monitor pricing

Two details make the city-network line easy to misread. It is charged per hour, so 10,000 city-networks cost $0.74 every hour, $540 a month, not $0.74 a month. And you pay for the city-networks that actually send traffic, up to the maximum you set: a monitor capped at 10,000 for a local business that only ever sees 300 pays for 300. The first 100 are covered for the whole account, as a flat deduction each month, not per monitor.

What Internet Monitor costs: four examples

The pattern is the same in every row: resources are cheap, city-networks are what the bill is made of, and the city-networks maximum is the dial. The same arithmetic puts a global company monitoring 50,000 city-networks at around $2,700 a month for that part, and a company in fewer areas with 200 city-networks at around $13.

The third row is worth a second look. Copy-paste examples for creating a monitor often use --max-city-networks-to-monitor 10000, a sensible value for a global application and an expensive one to paste unchanged for a small one if its traffic is broad. Set the cap from your own audience, as the next section shows.

Choosing a city-networks maximum that fits your users

1. Start low. For a business that serves one country or region, create the monitor with a maximum of 100 to 500. At 100, everything you monitor sits inside the free allowance.
2. Watch for a week. Compare the monitor's monitored bytes transferred with bytes transferred: the closer they are, the more of your traffic the cap already covers. If the city-networks you see include the users you care about, stop there.
3. Raise it in steps only if important users are missing: aws internetmonitor update-monitor --monitor-name shop-store --max-city-networks-to-monitor 500, or Action, Update monitor in the console. Each extra 100 adds about $5.40 a month.
4. Lower the traffic percentage instead of the cap if you want the same geographic spread at lower volume.

Remember the 100 free city-networks are per account. Two monitors with 100 each use 200 between them, so the second 100 is billed.

How to set up Internet Monitor: console and CLI

In the console:

1. Open the CloudWatch console. In the left pane, under Network Monitoring, choose Internet monitors, then Create monitor.
2. Enter a monitor name (it cannot be changed later).
3. Choose Add resources and pick your CloudFront distributions, or your VPCs, or your Network Load Balancers, or a WorkSpaces directory: one type per monitor. A VPC needs an internet gateway to produce useful data.
4. Leave the traffic percentage at 100%, or lower it.
5. Set the city-networks maximum from the previous section. This is the step people skip and regret.
6. Optionally turn on publishing measurements to an S3 bucket.
7. Choose Create monitor and give it 15 to 30 minutes before you look at the dashboard.

With the AWS CLI, the same monitor for a CloudFront distribution, capped at 100 city-networks:

aws internetmonitor create-monitor --monitor-name "shop-store" \
  --resources "arn:aws:cloudfront::123456789012:distribution/E2EXAMPLE1234" \
  --traffic-percentage-to-monitor 100 \
  --max-city-networks-to-monitor 100

Then check its state, list health events, and change the cap later:

aws internetmonitor get-monitor --monitor-name "shop-store"
aws internetmonitor list-health-events --monitor-name "shop-store"
aws internetmonitor update-monitor --monitor-name "shop-store" --max-city-networks-to-monitor 300

get-monitor returns "Status": "ACTIVE" and a ProcessingStatus of OK once data is flowing. Use your own distribution ID or VPC ARN in place of the example. To stop all charges, delete the monitor: aws internetmonitor delete-monitor --monitor-name "shop-store".

Getting alerted when the internet breaks for your users

Health events go to Amazon EventBridge automatically, so alerting is an EventBridge rule rather than a CloudWatch alarm on a metric. In the EventBridge console, create a rule, choose AWS events as the source, pick the Internet Monitor service and its health event type, and send it to an SNS topic that emails or messages you. Test the rule with the console's sample event before you rely on it; if it never fires, EventBridge rule never fires covers the usual pattern mistakes.

For a small site, the default 95% thresholds can be noisy at night when traffic is low; raise the local-impact threshold, or alert only on overall impact, until the alerts match what your customers actually notice.

Internet Monitor vs Network Synthetic Monitor vs Network Flow Monitor vs RUM

They answer different questions. Internet Monitor: "is the internet between my users and AWS healthy?" Synthetic Monitor: "is my office or data center link to AWS healthy?" Flow Monitor: "is the network inside my AWS setup healthy?" RUM: "what did the user's browser actually experience?" A public website with users spread around usually wants Internet Monitor and RUM together; a company with a data center connected to AWS adds Synthetic Monitor.

Is Internet Monitor worth it?

• Yes when you get location-specific complaints you cannot reproduce, when you need to tell a customer or a provider whose fault an outage was, or when you are choosing a Region or deciding whether CloudFront would help users in a specific country. At $7.30 to $15 a month for a capped monitor, one resolved argument pays for a year.
• Not yet when nearly all your users are in one city on one or two providers, or when your problems are inside the application (slow database, errors); CloudWatch metrics, X-Ray and RUM tell you more there.
• Be careful with large, global audiences: monitoring every city-network can cost thousands of dollars a month, so start capped and raise the cap only for the regions that matter.

Troubleshooting by symptom

The dashboard is empty after creating the monitor

It needs 15 to 30 minutes to build the traffic profile, and longer for a resource with very little traffic. Check get-monitor for ProcessingStatus OK.

A VPC monitor shows no data

The VPC needs an internet gateway and real internet-facing traffic. Private-only VPCs produce nothing useful.

I cannot add a CloudFront distribution and a VPC to the same monitor

Each monitor takes one resource type. Create one monitor for the distributions and another for the VPCs.

The bill is higher than expected

Check the city-networks maximum and the number of monitors; the free 100 city-networks are per account. Lower the cap or the traffic percentage with update-monitor.

CloudWatch Logs costs went up after turning it on

Measurement logs for the top 500 city-networks arrive every five minutes. Set a retention period on the log group so they do not pile up forever.

Health events fire too often

Raise the thresholds from the 95% default, or alert only on overall impact, so low-traffic hours do not trigger events.

I cannot find my monitor's data in another Region

A monitor stores data only in the Region where you created it, even if its resources are elsewhere. Switch the console to that Region.

I cannot rename a monitor

Names are fixed. Create a new monitor with the right name and delete the old one.

Frequently asked questions

Jake forwarded the provider's name to the three customers with a polite note. A week later one of them wrote back that the provider had replaced a faulty router in their town and the store now loaded instantly. "So I paid seven dollars to find out it wasn't us," Jake said. Ethan nodded. "Cheapest seven dollars you'll ever spend."

Revision note. Written October 23, 2026, with Internet Monitor, Network Synthetic Monitor and Network Flow Monitor prices from the AWS price list for US East (N. Virginia) and the CloudWatch user guide as they stood on that date. "Don't shoot the messenger," the saying goes; Internet Monitor is the messenger, and it usually points at someone else's router.