# Ensure CloudFront distributions have logging enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292190769612-ensure-cloudfront-distributions-have-logging-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon CloudFront distribution records the requests it receives. A distribution is compliant if at least one logging method is active: standard (legacy) access logs delivered to Amazon S3, a real-time log configuration attached to the default cache behavior (not another cache behavior), or standard logging (v2) with a CloudWatch Logs delivery source and at least one delivery to Amazon S3, CloudWatch Logs or Amazon Data Firehose. **Rationale** Without CloudFront logs, there is no record of the requests reaching the edge, which makes it difficult to detect bot abuse, credential stuffing, scanning or attempts to bypass the cache. It also delays incident response and leaves little forensic evidence. Enabling access logs or real-time logs for all distributions, storing them with least-privilege access and suitable retention, and analyzing them centrally with alerts, provides this visibility. **Impact** - Records each viewer request, including the client IP address, requested URL, status code and user agent - Supports security monitoring, incident investigation and troubleshooting - Log storage and delivery are charged (S3 storage, CloudWatch Logs or Data Firehose charges, and real-time log charges), and log files may contain personal data such as IP addresses **Default Value** Logging is disabled for new CloudFront distributions. **Pre-Requisites** - IAM permissions: cloudfront:GetDistributionConfig, cloudfront:UpdateDistribution, logs:DescribeDeliverySources and logs:DescribeDeliveries, plus s3:GetBucketAcl and s3:PutBucketAcl on the log bucket for S3 logging - An S3 bucket for the logs. For legacy S3 access logs, the bucket must have ACLs enabled (Object Ownership not set to **Bucket owner enforced**) - A decision on the log retention period and who may access the logs **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console and select **Distributions**. 3. Select a distribution and open the **Logging** tab. 4. Check that a standard log destination (Amazon S3, CloudWatch Logs or Data Firehose) is configured, that legacy standard logging is turned on, or that a real-time log configuration is attached to the default cache behavior. 5. Repeat for each distribution. 6. If no logging is configured, follow the implementation steps. **CLI:** Show the legacy S3 logging setting and the real-time log configuration of the default cache behavior: aws cloudfront get-distribution-config --id --query "DistributionConfig.\[Logging.Enabled,Logging.Bucket,DefaultCacheBehavior.RealtimeLogConfigArn\]" --output table List the CloudFront log delivery sources (standard logging v2), which are always in the US East (N. Virginia) region: aws logs describe-delivery-sources --region us-east-1 --query "deliverySources\[?service=='cloudfront'\].\[name,resourceArns\[0\]\]" --output table List the active deliveries and their sources: aws logs describe-deliveries --region us-east-1 --query "deliveries\[\].\[deliverySourceName,deliveryDestinationArn\]" --output table A distribution fails if Logging.Enabled is False, the default cache behavior's RealtimeLogConfigArn is empty, and there is no delivery source for its ARN that has at least one delivery to any destination. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console and select the distribution. 3. Open the **Logging** tab and add a standard log destination: Amazon S3, CloudWatch Logs or Data Firehose. 4. Select or create the destination (for example the S3 bucket for the logs), and choose the log format and fields if needed. 5. Save the log delivery. 6. Repeat for each distribution. **CLI:** The following steps turn on legacy standard logging to S3. Run each command separately: update-distribution accepts only the inner DistributionConfig object together with the current ETag, not the full get-distribution-config output. Setting only Logging.Bucket is not enough; Logging.Enabled must also be true. Save the distribution configuration and get its current ETag: aws cloudfront get-distribution-config --id --query "DistributionConfig" --output json > dist-config.json aws cloudfront get-distribution-config --id --query "ETag" --output text Edit dist-config.json and replace the Logging value with: {"Enabled":true,"IncludeCookies":false,"Bucket":".s3.amazonaws.com","Prefix":""} Apply the updated configuration with the ETag: aws cloudfront update-distribution --id --distribution-config file://dist-config.json --if-match **Backout Plan** Before making changes, save the current distribution configuration: aws cloudfront get-distribution-config --id --query "DistributionConfig" --output json > dist-config-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console, select the distribution and open the **Logging** tab. 3. Delete the log delivery that was added, or turn off legacy standard logging. 4. Save the changes. **CLI:** Get the current ETag with the command used in the implementation steps, then restore the saved configuration: aws cloudfront update-distribution --id --distribution-config file://dist-config-backup.json --if-match Note: rolling back stops recording requests to the distribution. Logs already delivered are kept in the destination. **Reference** - [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html) - [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html) - [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.