AWS CloudFront Logging Not Enabled

Description:

AWS CloudFront is a content delivery network (CDN) service that can be used to distribute content to users with low latency and high data transfer speeds. By default, CloudFront does not save logs detailing each request made to your distribution. However, enabling logging on your CloudFront distribution is crucial for monitoring, troubleshooting, and analyzing the traffic served by the distribution. Without logs, it becomes difficult to trace issues, understand user behavior, or detect potential security threats.

Remediation:

1. Enable CloudFront Access Logging:

AWS Management Console:

• Navigate to the CloudFront service.
• In the list of distributions, click the ID of the distribution you wish to update.
• Choose the General tab.
• Click Edit.
• In the Distribution Settings section, find the Logging setting.
• Set the Bucket for Logs to the S3 bucket where you want to store the logs.
• (Optional) Specify a Log Prefix to organize the saved log files.
• Click Yes, Edit to save the changes.

Terraform:

To enable logging for a CloudFront distribution using Terraform, you can use the following snippet:

resource "aws_cloudfront_distribution" "s3_distribution" {
  # ... other configuration ...

  logging_config {
    include_cookies = false
    bucket          = "my-log-bucket.s3.amazonaws.com"
    prefix          = "cloudfront-logs/" # Optional log prefix
  }

  # ... other configuration ...
}

Replace my-log-bucket.s3.amazonaws.com with the name of your S3 bucket where you wish to store the logs.

Recommendation:

Always enable logging for CloudFront distributions. Logging provides valuable insights into the traffic patterns and behaviors associated with your content delivery. Regularly review the generated logs to detect anomalies, understand usage patterns, and enhance security monitoring. Consider integrating CloudFront logs with other AWS services like Athena or QuickSight for advanced analysis and visualization. If storage costs are a concern, implement lifecycle policies on the logging S3 bucket to transition older logs to cheaper storage classes or delete them after a defined retention period.