Project: KICS (Provisioning / Security & Compliance)
File: de77cd9f-0e8b-46cc-b4a4-b6b436838642.md

title: CloudFront Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: de77cd9f-0e8b-46cc-b4a4-b6b436838642 Query name: CloudFront Logging Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: AWS CloudFront distributions should have logging enabled to collect all viewer requests, which means the attribute 'DistributionConfig.Logging' should be defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" AWSTemplateFormatVersion: '2010-09-09' Resources: myDistribution1: Type: AWS::CloudFront::Distribution Properties: DefaultCacheBehavior: AllowedMethods: GET HEAD OPTIONS TargetOriginId: myS3Origin ForwardedValues: QueryString: 'false' Cookies: Forward: none TrustedSigners: 1234567890EX ViewerProtocolPolicy: allow-all DistributionConfig: Origins: DomainName: mybucket.s3.amazonaws.com Id: myS3Origin S3OriginConfig: OriginAccessIdentity: origin-access-identity/cloudfront/E127EXAMPLE51Z Enabled: 'true' Comment: Some comment DefaultRootObject: index.html ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="30" AWSTemplateFormatVersion: '2010-09-09' Resources: myDistribution2: Type: AWS::CloudFront::Distribution Properties: DefaultCacheBehavior: AllowedMethods: GET HEAD OPTIONS TargetOriginId: myS3Origin ForwardedValues: QueryString: 'false' Cookies: Forward: none TrustedSigners: 1234567890EX ViewerProtocolPolicy: allow-all DistributionConfig: Origins: DomainName: mybucket.s3.amazonaws.com Id: myS3Origin S3OriginConfig: OriginAccessIdentity: origin-access-identity/cloudfront/E127EXAMPLE51Z Enabled: 'true' Comment: Some comment DefaultRootObject: index.html Logging: IncludeCookies: 'false' Bucket: mylogs.amazonaws.com Prefix: myprefix ``` ```json title="Positive test num. 3 - json file" hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myDistribution1": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DefaultCacheBehavior": { "AllowedMethods": [ "GET", "HEAD", "OPTIONS" ], "TargetOriginId": "myS3Origin", "ForwardedValues": { "QueryString": "false", "Cookies": { "Forward": "none" } }, "TrustedSigners": [ "1234567890EX" ], "ViewerProtocolPolicy": "allow-all" }, "DistributionConfig": { "Origins": [ { "DomainName": "mybucket.s3.amazonaws.com", "Id": "myS3Origin", "S3OriginConfig": { "OriginAccessIdentity": "origin-access-identity/cloudfront/E127EXAMPLE51Z" } } ], "Enabled": "true", "Comment": "Some comment", "DefaultRootObject": "index.html" } } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="40" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myDistribution2": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DefaultCacheBehavior": { "AllowedMethods": [ "GET", "HEAD", "OPTIONS" ], "TargetOriginId": "myS3Origin", "ForwardedValues": { "QueryString": "false", "Cookies": { "Forward": "none" } }, "TrustedSigners": [ "1234567890EX" ], "ViewerProtocolPolicy": "allow-all" }, "DistributionConfig": { "Origins": [ { "S3OriginConfig": { "OriginAccessIdentity": "origin-access-identity/cloudfront/E127EXAMPLE51Z" }, "DomainName": "mybucket.s3.amazonaws.com", "Id": "myS3Origin" } ], "Enabled": "true", "Comment": "Some comment", "DefaultRootObject": "index.html", "Logging": { "IncludeCookies": "false", "Bucket": "mylogs.amazonaws.com", "Prefix": "myprefix" } } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Resources: myDistribution3: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Origins: DomainName: mybucket.s3.amazonaws.com Id: myS3Origin S3OriginConfig: OriginAccessIdentity: origin-access-identity/cloudfront/E127EXAMPLE51Z Enabled: 'true' Comment: Some comment DefaultRootObject: index.html Logging: IncludeCookies: 'false' Bucket: mylogs.s3.amazonaws.com Prefix: myprefix DefaultCacheBehavior: AllowedMethods: GET HEAD OPTIONS TargetOriginId: myS3Origin ForwardedValues: QueryString: 'false' Cookies: Forward: none TrustedSigners: 1234567890EX ViewerProtocolPolicy: allow-all ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myDistribution3": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Logging": { "IncludeCookies": "false", "Bucket": "mylogs.s3.amazonaws.com", "Prefix": "myprefix" }, "Origins": [ { "DomainName": "mybucket.s3.amazonaws.com", "Id": "myS3Origin", "S3OriginConfig": { "OriginAccessIdentity": "origin-access-identity/cloudfront/E127EXAMPLE51Z" } } ], "Enabled": "true", "Comment": "Some comment", "DefaultRootObject": "index.html" } }, "DefaultCacheBehavior": { "ForwardedValues": { "Cookies": { "Forward": "none" }, "QueryString": "false" }, "TrustedSigners": [ "1234567890EX" ], "ViewerProtocolPolicy": "allow-all", "AllowedMethods": [ "GET", "HEAD", "OPTIONS" ], "TargetOriginId": "myS3Origin" } } } } ```