To get the CloudFront metrics from the CloudWatch API, you must use the US East (N. Virginia) Region (us-east-1) so the first check would be to see if the custom.properties of the ActiveGate that you're using has this region set.
In order for you to do this, navigate to the ActiveGate host, locate the custom.properties file and edit it.
Make sure to add the "us-east-1" region. To add multiple regions, you can see below how the format should look like
aws_monitoring_enabled = true
aws_client_regions = "eu-west-1;us-east-1"
Save the changes and a restart of the ActiveGate is necessary.
On the AWS side, the credentials must have at least these permissions for