> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Logging Should Be Enabled For CloudFront Distributions ### More Info: Ensure that your AWS Cloudfront distributions have the Logging feature enabled in order to track all viewer requests for the content delivered through the Content Delivery Network (CDN). ### Risk Level Low ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * StateRAMP * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Logging Should Be Enabled For CloudFront Distributions" for AWS using AWS console, follow the below steps: 1. Login to the AWS Management Console and navigate to the CloudFront service. 2. Click on the CloudFront distribution for which you want to enable logging. 3. Click on the "Behaviors" tab and select the behavior for which you want to enable logging. 4. Scroll down to the "Logging" section and click on "Edit". 5. Select "Yes" for "Enable Logging". 6. Choose the S3 bucket where you want to store the logs. 7. Enter the prefix for the log files (optional). 8. Click on "Yes, Edit" to save the changes. Once you have completed the above steps, logging will be enabled for your CloudFront distribution and all the logs will be stored in the specified S3 bucket. # To remediate the misconfiguration "Logging should be enabled for CloudFront distributions" for AWS using AWS CLI, you can follow the below steps: 1. Open the AWS CLI and run the following command to enable logging for a CloudFront distribution: ``` aws cloudfront update-distribution --id --logging-enabled --bucket --prefix ``` Note: Replace `` with the ID of the CloudFront distribution for which you want to enable logging and replace `` and `` with the name of the S3 bucket and prefix where you want to store the logs. 2. Verify that the logging is enabled for the CloudFront distribution by running the following command: ``` aws cloudfront get-distribution --id | grep Logging ``` Note: Replace `` with the ID of the CloudFront distribution for which you want to verify the logging. 3. Ensure that the logging is working properly by checking the S3 bucket where the logs are stored. By following the above steps, you can remediate the misconfiguration "Logging should be enabled for CloudFront distributions" for AWS using AWS CLI. To remediate the misconfiguration of logging not being enabled for CloudFront distributions in AWS using Python, you can follow the below steps: 1. Import the necessary AWS SDK modules for Python: ``` import boto3 ``` 2. Create an AWS CloudFront client object: ``` client = boto3.client('cloudfront') ``` 3. Get a list of all the CloudFront distributions in your AWS account: ``` distributions = client.list_distributions() ``` 4. For each distribution, check if logging is enabled or not: ``` for distribution in distributions['DistributionList']['Items']: logging_enabled = distribution['Logging']['Enabled'] if logging_enabled == False: # Logging is not enabled, enable it distribution_id = distribution['Id'] client.update_distribution( DistributionConfig={ 'Id': distribution_id, 'Logging': { 'Enabled': True, 'IncludeCookies': False, 'Bucket': 'your-logging-bucket-name', 'Prefix': 'your-logging-prefix' }, 'Comment': 'Enable logging for CloudFront distribution' }, IfMatch=distribution['ETag'] ) ``` 5. Replace 'your-logging-bucket-name' and 'your-logging-prefix' with the name of the S3 bucket and prefix where you want to store the CloudFront access logs. 6. Run the Python script to enable logging for all the CloudFront distributions in your AWS account. This will remediate the misconfiguration of logging not being enabled for CloudFront distributions in AWS. ```hcl theme={null} resource "aws_s3_bucket" "cloudfront_logs" { bucket = "CLOUDFRONT_LOG_BUCKET_NAME" # replace with your log bucket name } resource "aws_s3_bucket_policy" "cloudfront_logs" { bucket = aws_s3_bucket.cloudfront_logs.id policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "AllowCloudFrontLogs" Effect = "Allow" Principal = { Service = "delivery.logs.amazonaws.com" } Action = "s3:PutObject" Resource = "${aws_s3_bucket.cloudfront_logs.arn}/LOG_PREFIX_PLACEHOLDER/*" # replace prefix Condition = { StringEquals = { "s3:x-amz-acl" = "bucket-owner-full-control" } } } ] }) } resource "aws_cloudfront_distribution" "this" { # existing required arguments enabled = true default_root_object = "index.html" origins { domain_name = "ORIGIN_DOMAIN_NAME" # e.g. myapp.s3.amazonaws.com origin_id = "ORIGIN_ID" } default_cache_behavior { target_origin_id = "ORIGIN_ID" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] } # Logging configuration – this is the required fix logging_config { bucket = "${aws_s3_bucket.cloudfront_logs.bucket_regional_domain_name}" include_cookies = false prefix = "LOG_PREFIX_PLACEHOLDER/" # replace with desired log prefix or "" for none } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } ``` This change enables CloudFront access logging to an S3 bucket and grants the `delivery.logs.amazonaws.com` service (CloudFront logs delivery) permission to write logs; it does not normally force distribution replacement, but will show as an in‑place update. To verify, `terraform plan` should show an in-place update (`~`) to `aws_cloudfront_distribution.this` adding/updating the `logging_config` block, plus creation (`+`) of the S3 bucket and its policy if they are new. ### Additional Reading: * [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html)