Enable Logging

1. Log in to the AWS Management Console.

2. Select the “Services” option and search for CloudFront.

3. Select the “CloudFront Distribution” that needs to be verified.

4. Click on the selected Distribution to get into the CloudFront Distribution configuration page.

5. In the “General” tab scroll down to settings and verify the “Standard logging” feature configuration status. If Logging is “Off” then it cannot create log files that contain detailed information about every user request that CloudFront receives.

6. To change the status click on “Edit” to get to the “Edit Settings” page. Scroll down to “Standard Logging” and select the “On” option to initiate the Logging feature of CloudFront to log all viewer requests for files in your distribution.

7. Click on “Bucket for Logs” feature and specify the Amazon S3 bucket in which you want CloudFront to save web access logs.

8. Click on Log Prefix which is optional for the names of log files.

9. Scroll down and click on “Save changes” to save the new settings.

10. Repeat the steps number 3 to 9 to verify if any other “CloudFront Distribution” has Logging enabled or not.

Enable logging for CloudFront distributions

1
2
3
4
5
6
7
8
9

 resource "aws_cloudfront_distribution" "good_example" {
 	// other config
 	logging_config {
 		include_cookies = false
 		bucket          = "mylogs.s3.amazonaws.com"
 		prefix          = "myprefix"
 	}
 }
 

Remediation Links

• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#logging_config