Back to Checks
aws

CloudFront distribution has logging enabled

cloudfront_distributions_logging_enabled
Service: cloudfrontSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsCloudFrontDistribution

CloudFront distributions record viewer requests using standard access logs (S3), real-time log configurations, or Standard Logging v2 via CloudWatch Logs delivery sources.

The finding evaluates whether at least one logging mechanism is active so request metadata is captured for each distribution.

Prowler logoProwlerprowler-provider-aws

Risk

Missing CloudFront logs blinds monitoring of edge requests, impeding detection of bot abuse, credential stuffing, and cache-bypass attempts.

This delays incident response and weakens forensic evidence. A delivery source without an active delivery does not count as enabled.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_logging_enabled

Recommendation

Enable standard access logs or real-time logs for all distributions.

Apply least privilege to log storage, enforce retention and immutability, and centralize ingestion with alerts.

Use defense-in-depth: correlate with WAF metrics, sample real-time when needed, and audit new distributions for logging.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add Logging.Bucket: <example_bucket>.s3.amazonaws.com', then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

# Add this block to your existing CloudFront distribution to enable access logging
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  # ... existing required config ...
  logging_config {
    bucket = "<example_bucket>.s3.amazonaws.com"  # CRITICAL: enables standard access logs to S3
  }
}

NativeIaC

# CloudFormation: enable CloudFront standard access logging
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: origin1
            DomainName: <example_origin_domain>
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: origin1
          ViewerProtocolPolicy: allow-all
        Logging:
          Bucket: <example_bucket>.s3.amazonaws.com  # CRITICAL: enables standard access logs to S3 for this distribution
          # The presence of Logging with Bucket turns on access logging

Other

1In the AWS Console, go to CloudFront and select your distribution
2Open the General tab and click Edit
3In Standard logging, set to On
4Select the S3 bucket to receive logs
5Ensure the S3 bucket has Object Ownership set to ACLs enabled (Bucket owner preferred/ObjectWriter)
6Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)


class cloudfront_distributions_logging_enabled(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
            has_legacy_logging = distribution.logging_enabled
            has_realtime_logging = (
                distribution.default_cache_config
                and distribution.default_cache_config.realtime_log_config_arn
            )
            has_v2_logging = distribution.logging_v2_enabled

            if has_legacy_logging or has_realtime_logging or has_v2_logging:
                methods = []
                if has_legacy_logging:
                    methods.append("standard")
                if has_realtime_logging:
                    methods.append("real-time")
                if has_v2_logging:
                    methods.append("v2/CloudWatch")
                report.status = "PASS"
                report.status_extended = f"CloudFront Distribution {distribution.id} has logging enabled via {', '.join(methods)}."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"CloudFront Distribution {distribution.id} has logging disabled."
                )
            findings.append(report)

        return findings

References