Logging Should Be Enabled For CloudFront Distributions

Using Console

To remediate the misconfiguration “Logging Should Be Enabled For CloudFront Distributions” for AWS using AWS console, follow the below steps:

Login to the AWS Management Console and navigate to the CloudFront service.
Click on the CloudFront distribution for which you want to enable logging.
Click on the “Behaviors” tab and select the behavior for which you want to enable logging.
Scroll down to the “Logging” section and click on “Edit”.
Select “Yes” for “Enable Logging”.
Choose the S3 bucket where you want to store the logs.
Enter the prefix for the log files (optional).
Click on “Yes, Edit” to save the changes.

Once you have completed the above steps, logging will be enabled for your CloudFront distribution and all the logs will be stored in the specified S3 bucket.

Using CLI

To remediate the misconfiguration “Logging should be enabled for CloudFront distributions” for AWS using AWS CLI, you can follow the below steps:

Open the AWS CLI and run the following command to enable logging for a CloudFront distribution:

aws cloudfront update-distribution --id <distribution-id> --logging-enabled --bucket <S3-bucket-name> --prefix <S3-prefix>

Note: Replace <distribution-id> with the ID of the CloudFront distribution for which you want to enable logging and replace <S3-bucket-name> and <S3-prefix> with the name of the S3 bucket and prefix where you want to store the logs.

Verify that the logging is enabled for the CloudFront distribution by running the following command:

aws cloudfront get-distribution --id <distribution-id> | grep Logging

Note: Replace <distribution-id> with the ID of the CloudFront distribution for which you want to verify the logging.

Ensure that the logging is working properly by checking the S3 bucket where the logs are stored.

By following the above steps, you can remediate the misconfiguration “Logging should be enabled for CloudFront distributions” for AWS using AWS CLI.

Using Python

To remediate the misconfiguration of logging not being enabled for CloudFront distributions in AWS using Python, you can follow the below steps:

Import the necessary AWS SDK modules for Python:

import boto3

Create an AWS CloudFront client object:

client = boto3.client('cloudfront')

Get a list of all the CloudFront distributions in your AWS account:

distributions = client.list_distributions()

For each distribution, check if logging is enabled or not:

for distribution in distributions['DistributionList']['Items']:
    logging_enabled = distribution['Logging']['Enabled']
    if logging_enabled == False:
        # Logging is not enabled, enable it
        distribution_id = distribution['Id']
        client.update_distribution(
            DistributionConfig={
                'Id': distribution_id,
                'Logging': {
                    'Enabled': True,
                    'IncludeCookies': False,
                    'Bucket': 'your-logging-bucket-name',
                    'Prefix': 'your-logging-prefix'
                },
                'Comment': 'Enable logging for CloudFront distribution'
            },
            IfMatch=distribution['ETag']
        )

Replace ‘your-logging-bucket-name’ and ‘your-logging-prefix’ with the name of the S3 bucket and prefix where you want to store the CloudFront access logs.
Run the Python script to enable logging for all the CloudFront distributions in your AWS account.

This will remediate the misconfiguration of logging not being enabled for CloudFront distributions in AWS.

Using Terraform

resource "aws_s3_bucket" "cloudfront_logs" {
  bucket = "CLOUDFRONT_LOG_BUCKET_NAME" # replace with your log bucket name
}

resource "aws_s3_bucket_policy" "cloudfront_logs" {
  bucket = aws_s3_bucket.cloudfront_logs.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "AllowCloudFrontLogs"
        Effect    = "Allow"
        Principal = {
          Service = "delivery.logs.amazonaws.com"
        }
        Action   = "s3:PutObject"
        Resource = "${aws_s3_bucket.cloudfront_logs.arn}/LOG_PREFIX_PLACEHOLDER/*" # replace prefix
        Condition = {
          StringEquals = {
            "s3:x-amz-acl" = "bucket-owner-full-control"
          }
        }
      }
    ]
  })
}

resource "aws_cloudfront_distribution" "this" {
  # existing required arguments
  enabled             = true
  default_root_object = "index.html"

  origins {
    domain_name = "ORIGIN_DOMAIN_NAME"  # e.g. myapp.s3.amazonaws.com
    origin_id   = "ORIGIN_ID"
  }

  default_cache_behavior {
    target_origin_id       = "ORIGIN_ID"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
  }

  # Logging configuration – this is the required fix
  logging_config {
    bucket          = "${aws_s3_bucket.cloudfront_logs.bucket_regional_domain_name}"
    include_cookies = false
    prefix          = "LOG_PREFIX_PLACEHOLDER/" # replace with desired log prefix or "" for none
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

This change enables CloudFront access logging to an S3 bucket and grants the delivery.logs.amazonaws.com service (CloudFront logs delivery) permission to write logs; it does not normally force distribution replacement, but will show as an in‑place update.To verify, terraform plan should show an in-place update (~) to aws_cloudfront_distribution.this adding/updating the logging_config block, plus creation (+) of the S3 bucket and its policy if they are new.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Logging Should Be Enabled For CloudFront Distributions

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: