All checks
Medium
CloudFront distributions should have logging enabled
Checks that standard logging (legacy) is on for the CloudFront distribution, recording every request for security audits and investigations. As in AWS's control, only the legacy setting counts: standard logging (v2) and real-time logs do not clear it, though they can run alongside it, and whether log files reach the bucket is not checked.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
CloudFront → Distributions → the distribution → Logging → Standard logging, delivered to Amazon S3 (Legacy)
- Log delivery
- On, delivering to Amazon S3 (Legacy)
- S3 bucket
- ACLs enabled, in a Region enabled by default; for SSE-KMS, a customer managed key delivery.logs.amazonaws.com can use
See which of your accounts this check is failing on.
Book a live scan