AWS CloudFront distribution with access logging disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_86
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	81e103d7-6ba6-42d6-ace7-dfdcff88693a

Impact

Cloudfront access logs contain detailed information (requested object name, date and time of the access, client IP, access point, error code, etc) about each request made for your web content. This information can be extremely useful during security audits, or as input data for various analytics/reporting tools. Pairing with Lambda and WAF logs could help expedite a response process and possibly enable blocking requests coming from IP addresses that generate multiple errors. These spikes in errors could possibly indicate they were made by attackers trying to find vulnerabilities within your web application.

How to Fix

• Resource: AWS::CloudFront::Distribution
• Arguments: Properties.DistributionConfig.Logging/Bucket [source,go]

---

Resources: MyCloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: ... DistributionConfig: ...

• Logging:
• Bucket: myawslogbucket.s3.amazonaws.com

---