Logging Should Be Enabled For CloudFront Distributions
More Info:
Ensure that your AWS Cloudfront distributions have the Logging feature enabled in order to track all viewer requests for the content delivered through the Content Delivery Network (CDN).Risk Level
LowAddress
SecurityCompliance Standards
SOC2, HITRUST, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Logging Should Be Enabled For CloudFront Distributions” for AWS using AWS console, follow the below steps:
- Login to the AWS Management Console and navigate to the CloudFront service.
- Click on the CloudFront distribution for which you want to enable logging.
- Click on the “Behaviors” tab and select the behavior for which you want to enable logging.
- Scroll down to the “Logging” section and click on “Edit”.
- Select “Yes” for “Enable Logging”.
- Choose the S3 bucket where you want to store the logs.
- Enter the prefix for the log files (optional).
- Click on “Yes, Edit” to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Logging should be enabled for CloudFront distributions” for AWS using AWS CLI, you can follow the below steps:Note: Replace Note: Replace
- Open the AWS CLI and run the following command to enable logging for a CloudFront distribution:
<distribution-id> with the ID of the CloudFront distribution for which you want to enable logging and replace <S3-bucket-name> and <S3-prefix> with the name of the S3 bucket and prefix where you want to store the logs.- Verify that the logging is enabled for the CloudFront distribution by running the following command:
<distribution-id> with the ID of the CloudFront distribution for which you want to verify the logging.- Ensure that the logging is working properly by checking the S3 bucket where the logs are stored.
Using Python
Using Python
To remediate the misconfiguration of logging not being enabled for CloudFront distributions in AWS using Python, you can follow the below steps:
- Import the necessary AWS SDK modules for Python:
- Create an AWS CloudFront client object:
- Get a list of all the CloudFront distributions in your AWS account:
- For each distribution, check if logging is enabled or not:
- Replace ‘your-logging-bucket-name’ and ‘your-logging-prefix’ with the name of the S3 bucket and prefix where you want to store the CloudFront access logs.
- Run the Python script to enable logging for all the CloudFront distributions in your AWS account.