Configure standard logging (v2)

Use the CloudFront console to create a new distribution or update an existing one.

Under the Standard logging section, for Log delivery, choose On.

(Optional) For Cookie logging, specify if you want to include cookies in your logs.

For the Deliver to section, specify the service to receive your logs:

For the Destination, select the resource for your service. If you haven’t already created your resource, you can choose Create or see the following documentation.

For Additional settings – optional, you can specify the following options:

1. For Field selection, select the log field names that you want to deliver to your destination. You can select access log fields and a subset of real-time log fields.

2. (Amazon S3 only) For Partitioning, specify the path to partition your log file data.

3. (Amazon S3 only) For Hive-compatible file format, you can select the checkbox to use Hive-compatible S3 paths. This helps simplify loading new data into your Hive-compatible tools.

4. For Output format, specify your preferred format.

   Note

   If you choose Parquet, this option incurs CloudWatch charges for converting your access logs to Apache Parquet. For more information, see the Vended Logs section for CloudWatch pricing.

5. For Field delimiter, specify how to separate log fields.

Complete the steps to update or create your distribution.

To add another destination, choose Add another destination and repeat steps 4 – 7.

From the Logs page, verify that the standard logs status is Enabled next to the distribution.

For more information about the standard logging delivery and log fields, see the Standard logging reference.

After you a create a distribution, get the Amazon Resource Name (ARN).

You can find the ARN from the Distribution page in the CloudFront console or you can use the GetDistribution API operation. A distribution ARN follows the format: arn:aws:cloudfront::123456789012:distribution/d111111abcdef8

Next, use the CloudWatch PutDeliverySource API operation to create a delivery source for the distribution.

1. Enter a name for the delivery source.

2. Pass the resourceArn of the distribution.

3. For logType, specify ACCESS_LOGS as the type of logs that are collected.

4. Example AWS CLI put-delivery-source command

   The following is an example of configuring a delivery source for a distribution.

   aws logs put-delivery-source --name S3-delivery --resource-arn arn:aws:cloudfront::123456789012:distribution/d111111abcdef8 --log-type ACCESS_LOGS

   Output

   {
    "deliverySource": {
    "name": "S3-delivery",
    "arn": "arn:aws:logs:us-east-1:123456789012:delivery-source:S3-delivery",
    "resourceArns": [
    "arn:aws:cloudfront::123456789012:distribution/d111111abcdef8"
    ],
    "service": "cloudfront",
    "logType": "ACCESS_LOGS"
    }
   } 

Use the PutDeliveryDestination API operation to configure where to store your logs.

1. For destinationResourceArn, specify the ARN of the destination. This can be a CloudWatch Logs log group, a Firehose delivery stream, or an Amazon S3 bucket.

2. For outputFormat, specify the output format for your logs.

3. Example AWS CLI put-delivery-destination command

   The following is an example of configuring a delivery destination to an Amazon S3 bucket.

   aws logs put-delivery-destination --name S3-destination --delivery-destination-configuration destinationResourceArn=arn:aws:s3:::amzn-s3-demo-bucket

   Output

   {
       "name": "S3-destination",
       "arn": "arn:aws:logs:us-east-1:123456789012:delivery-destination:S3-destination",
       "deliveryDestinationType": "S3",
       "deliveryDestinationConfiguration": {
           "destinationResourceArn": "arn:aws:s3:::amzn-s3-demo-bucket"
       }
   }

Use the CreateDelivery API operation to link the delivery source to the destination that you created in the previous steps. This API operation associates the delivery source with the end destination.

1. For deliverySourceName, specify the source name.

2. For deliveryDestinationArn, specify the ARN for the delivery destination.

3. For fieldDelimiter, specify the string to separate each log field.

4. For recordFields, specify the log fields that you want.

5. If you’re using S3, specify whether to use enableHiveCompatiblePath and suffixPath.

aws logs create-delivery --delivery-source-name cf-delivery --delivery-destination-arn arn:aws:logs:us-east-1:123456789012:delivery-destination:S3-destination

{
    "id": "abcNegnBoTR123",
    "arn": "arn:aws:logs:us-east-1:123456789012:delivery:abcNegnBoTR123",
    "deliverySourceName": "cf-delivery",
    "deliveryDestinationArn": "arn:aws:logs:us-east-1:123456789012:delivery-destination:S3-destination",
    "deliveryDestinationType": "S3",
    "recordFields": [
        "date",
        "time",
        "x-edge-location",
        "sc-bytes",
        "c-ip",
        "cs-method",
        "cs(Host)",
        "cs-uri-stem",
        "sc-status",
        "cs(Referer)",
        "cs(User-Agent)",
        "cs-uri-query",
        "cs(Cookie)",
        "x-edge-result-type",
        "x-edge-request-id",
        "x-host-header",
        "cs-protocol",
        "cs-bytes",
        "time-taken",
        "x-forwarded-for",
        "ssl-protocol",
        "ssl-cipher",
        "x-edge-response-result-type",
        "cs-protocol-version",
        "fle-status",
        "fle-encrypted-fields",
        "c-port",
        "time-to-first-byte",
        "x-edge-detailed-result-type",
        "sc-content-type",
        "sc-content-len",
        "sc-range-start",
        "sc-range-end",
        "c-country",
        "cache-behavior-path-pattern"
    ],
     "fieldDelimiter": ""
}

From the CloudFront console, on the Logs page, verify that the standard logs status is Enabled next to the distribution.

For more information about the standard logging delivery and log fields, see the Standard logging reference.

To create the log delivery destination, you can enter the following AWS CLI command. This example uses the MyLogPrefix string to create a prefix for your access logs.

aws logs put-delivery-destination --name cloudfront-delivery-destination --delivery-destination-configuration "destinationResourceArn=arn:aws:s3:::amzn-s3-demo-bucket-cloudfront-logs/MyLogPrefix"

Output

{
    "deliveryDestination": {
        "name": "cloudfront-delivery-destination",
        "arn": "arn:aws:logs:us-east-1:222222222222:delivery-destination:cloudfront-delivery-destination",
        "deliveryDestinationType": "S3",
        "deliveryDestinationConfiguration": {"destinationResourceArn": "arn:aws:s3:::amzn-s3-demo-bucket-cloudfront-logs/MyLogPrefix"}
    }
}

Add the resource policy for the log delivery destination to allow the source account to create a log delivery.

In the following policy, replace 111111111111 with the source account ID and specify the delivery destination ARN from the output in step 1.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCreateDelivery",
            "Effect": "Allow",
            "Principal": {"AWS": "111111111111"},
            "Action": ["logs:CreateDelivery"],
            "Resource": "arn:aws:logs:us-east-1:222222222222:delivery-destination:cloudfront-delivery-destination"
        }
    ]
}

Save the file, such as deliverypolicy.json.

To attach the previous policy to the delivery destination, enter the following AWS CLI command.

aws logs put-delivery-destination-policy --delivery-destination-name cloudfront-delivery-destination --delivery-destination-policy file://deliverypolicy.json

Add the below statement to the destination Amazon S3 bucket policy, replacing the resource ARN and the source account ID. This policy allows the delivery.logs.amazonaws.com service principal to perform the s3:PutObject action.

{
    "Sid": "AWSLogsDeliveryWrite",
    "Effect": "Allow",
    "Principal": {"Service": "delivery.logs.amazonaws.com"},
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::amzn-s3-demo-bucket-cloudfront-logs/*",
    "Condition": {
        "StringEquals": {
            "s3:x-amz-acl": "bucket-owner-full-control",
            "aws:SourceAccount": "111111111111"
        },
        "ArnLike": {"aws:SourceArn": "arn:aws:logs:us-east-1:111111111111:delivery-source:*"}
    }
}

If you're using AWS KMS for your bucket, add the following statement to the KMS key policy to grant permissions to the delivery.logs.amazonaws.com service principal.

{
    "Sid": "Allow Logs Delivery to use the key",
    "Effect": "Allow",
    "Principal": {"Service": "delivery.logs.amazonaws.com"},
    "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
    ],
    "Resource": "",
    "Condition": {
        "StringEquals": {"aws:SourceAccount": "111111111111"},
        "ArnLike": {"aws:SourceArn": "arn:aws:logs:us-east-1:111111111111:delivery-source:"}
    }
}

Create a delivery source for CloudFront standard logging so that you can send log files to CloudWatch Logs.

You can enter the following AWS CLI command, replacing the name and your distribution ARN.

aws logs put-delivery-source --name s3-cf-delivery --resource-arn arn:aws:cloudfront::111111111111:distribution/E1TR1RHV123ABC --log-type ACCESS_LOGS

Output

{
    "deliverySource": {
        "name": "s3-cf-delivery",
        "arn": "arn:aws:logs:us-east-1:111111111111:delivery-source:s3-cf-delivery",
        "resourceArns": ["arn:aws:cloudfront::111111111111:distribution/E1TR1RHV123ABC"],
        "service": "cloudfront",
        "logType": "ACCESS_LOGS"
    }
}

Create a delivery to map the source account's log delivery source and the destination account's log delivery destination.

In the following AWS CLI command, specify the delivery destination ARN from the output in Step 1: Configure the destination account.

aws logs create-delivery --delivery-source-name s3-cf-delivery --delivery-destination-arn arn:aws:logs:us-east-1:222222222222:delivery-destination:cloudfront-delivery-destination

Output

{
    "delivery": {
        "id": "OPmOpLahVzhx1234",
        "arn": "arn:aws:logs:us-east-1:111111111111:delivery:OPmOpLahVzhx1234",
        "deliverySourceName": "s3-cf-delivery",
        "deliveryDestinationArn": "arn:aws:logs:us-east-1:222222222222:delivery-destination:cloudfront-delivery-destination",
        "deliveryDestinationType": "S3",
        "recordFields": [
            "date",
            "time",
            "x-edge-location",
            "sc-bytes",
            "c-ip",
            "cs-method",
            "cs(Host)",
            "cs-uri-stem",
            "sc-status",
            "cs(Referer)",
            "cs(User-Agent)",
            "cs-uri-query",
            "cs(Cookie)",
            "x-edge-result-type",
            "x-edge-request-id",
            "x-host-header",
            "cs-protocol",
            "cs-bytes",
            "time-taken",
            "x-forwarded-for",
            "ssl-protocol",
            "ssl-cipher",
            "x-edge-response-result-type",
            "cs-protocol-version",
            "fle-status",
            "fle-encrypted-fields",
            "c-port",
            "time-to-first-byte",
            "x-edge-detailed-result-type",
            "sc-content-type",
            "sc-content-len",
            "sc-range-start",
            "sc-range-end",
            "c-country",
            "cache-behavior-path-pattern"
        ],
        "fieldDelimiter": "\t"
    }
}

Verify your cross-account delivery is successful.

1. From the source account, sign in to the CloudFront console and choose your distribution. On the Logging tab, under Type, you will see an entry created for the S3 cross-account log delivery.

2. From the destination account, sign in to the Amazon S3 console and choose your Amazon S3 bucket. You will see the prefix MyLogPrefix in the bucket name and any access logs delivered to that folder.

Sign in to the CloudFront console.

Choose Distribution and then choose your distribution ID.

Choose Logging and then under Standard log destinations, select the destination.

Choose Manage and then choose Delete.

Repeat the previous step if you have more than one standard logging.