Description

Ensure that every Amazon CloudFront distribution records the requests it receives. A distribution is compliant if at least one logging method is active: standard (legacy) access logs delivered to Amazon S3, a real-time log configuration attached to the default cache behavior (not another cache behavior), or standard logging (v2) with a CloudWatch Logs delivery source and at least one delivery to Amazon S3, CloudWatch Logs or Amazon Data Firehose.

Rationale

Without CloudFront logs, there is no record of the requests reaching the edge, which makes it difficult to detect bot abuse, credential stuffing, scanning or attempts to bypass the cache. It also delays incident response and leaves little forensic evidence. Enabling access logs or real-time logs for all distributions, storing them with least-privilege access and suitable retention, and analyzing them centrally with alerts, provides this visibility.

Impact

  • Records each viewer request, including the client IP address, requested URL, status code and user agent

  • Supports security monitoring, incident investigation and troubleshooting

  • Log storage and delivery are charged (S3 storage, CloudWatch Logs or Data Firehose charges, and real-time log charges), and log files may contain personal data such as IP addresses

Default Value

Logging is disabled for new CloudFront distributions.

Pre-Requisites

  • IAM permissions: cloudfront:GetDistributionConfig, cloudfront:UpdateDistribution, logs:DescribeDeliverySources and logs:DescribeDeliveries, plus s3:GetBucketAcl and s3:PutBucketAcl on the log bucket for S3 logging

  • An S3 bucket for the logs. For legacy S3 access logs, the bucket must have ACLs enabled (Object Ownership not set to Bucket owner enforced)

  • A decision on the log retention period and who may access the logs

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console and select Distributions.

  3. Select a distribution and open the Logging tab.

  4. Check that a standard log destination (Amazon S3, CloudWatch Logs or Data Firehose) is configured, that legacy standard logging is turned on, or that a real-time log configuration is attached to the default cache behavior.

  5. Repeat for each distribution.

  6. If no logging is configured, follow the implementation steps.

CLI:

Show the legacy S3 logging setting and the real-time log configuration of the default cache behavior:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig.[Logging.Enabled,Logging.Bucket,DefaultCacheBehavior.RealtimeLogConfigArn]" --output table

List the CloudFront log delivery sources (standard logging v2), which are always in the US East (N. Virginia) region:

aws logs describe-delivery-sources --region us-east-1 --query "deliverySources[?service=='cloudfront'].[name,resourceArns[0]]" --output table

List the active deliveries and their sources:

aws logs describe-deliveries --region us-east-1 --query "deliveries[].[deliverySourceName,deliveryDestinationArn]" --output table

A distribution fails if Logging.Enabled is False, the default cache behavior's RealtimeLogConfigArn is empty, and there is no delivery source for its ARN that has at least one delivery to any destination.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console and select the distribution.

  3. Open the Logging tab and add a standard log destination: Amazon S3, CloudWatch Logs or Data Firehose.

  4. Select or create the destination (for example the S3 bucket for the logs), and choose the log format and fields if needed.

  5. Save the log delivery.

  6. Repeat for each distribution.

CLI:

The following steps turn on legacy standard logging to S3. Run each command separately: update-distribution accepts only the inner DistributionConfig object together with the current ETag, not the full get-distribution-config output. Setting only Logging.Bucket is not enough; Logging.Enabled must also be true.

Save the distribution configuration and get its current ETag:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig" --output json > dist-config.json
aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text

Edit dist-config.json and replace the Logging value with:

{"Enabled":true,"IncludeCookies":false,"Bucket":"<LOG_BUCKET_NAME>.s3.amazonaws.com","Prefix":"<LOG_PREFIX>"}

Apply the updated configuration with the ETag:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config.json --if-match <ETAG>

Backout Plan

Before making changes, save the current distribution configuration:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig" --output json > dist-config-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console, select the distribution and open the Logging tab.

  3. Delete the log delivery that was added, or turn off legacy standard logging.

  4. Save the changes.

CLI:

Get the current ETag with the command used in the implementation steps, then restore the saved configuration:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config-backup.json --if-match <ETAG>

Note: rolling back stops recording requests to the distribution. Logs already delivered are kept in the destination.

Reference