CloudFront distribution has logging enabled

Check ID: cloudfront_distributions_logging_enabled
Provider: AWS
Service: cloudfront
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions record viewer requests using standard access logs (S3), real-time log configurations, or Standard Logging v2 via CloudWatch Logs delivery sources. The finding evaluates whether at least one logging mechanism is active so request metadata is captured for each distribution.

Risk

Missing CloudFront logs blinds monitoring of edge requests, impeding detection of bot abuse, credential stuffing, and cache-bypass attempts. This delays incident response and weakens forensic evidence. A delivery source without an active delivery does not count as enabled.

Recommendation

Enable standard access logs or real-time logs for all distributions. Apply least privilege to log storage, enforce retention and immutability, and centralize ingestion with alerts. Use defense-in-depth: correlate with WAF metrics, sample real-time when needed, and audit new distributions for logging.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to add Logging.Bucket: <example_bucket>.s3.amazonaws.com’, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

# Add this block to your existing CloudFront distribution to enable access logging
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  # ... existing required config ...
  logging_config {
    bucket = "<example_bucket>.s3.amazonaws.com"  # CRITICAL: enables standard access logs to S3
  }
}

# CloudFormation: enable CloudFront standard access logging
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: origin1
            DomainName: <example_origin_domain>
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: origin1
          ViewerProtocolPolicy: allow-all
        Logging:
          Bucket: <example_bucket>.s3.amazonaws.com  # CRITICAL: enables standard access logs to S3 for this distribution
          # The presence of Logging with Bucket turns on access logging

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution serves HTTPS requests using SNI CloudFront distribution has origin failover configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires