CloudFront access logs not appearing in S3 bucket after enabling logging for CDN distribution

Cloud Platforms Amazon Web Services (AWS)
, , , , , , , ,
1

I enabled access logging on our CloudFront distribution three days ago but no log files are appearing in the designated S3 bucket. I’ve verified the bucket exists and specified the correct path in CloudFront logging configuration.

CloudFront distribution settings show logging enabled:


Logging: Enabled
Bucket: cdn-logs.s3.amazonaws.com
Prefix: cloudfront/production/

The S3 bucket is in us-east-1, same region as our CloudFront distribution origin. I can manually upload files to this bucket without issues, so permissions seem fine from my account perspective. However, after 72 hours, the cloudfront/production/ prefix remains empty.

We need these logs for traffic analysis and security monitoring. What could be preventing CloudFront from delivering access logs to S3?

2

I don’t see any bucket policy configured currently - the bucket policy editor shows empty. Should I add something specific? The bucket doesn’t have encryption enabled.

3

CloudFront logging has specific requirements beyond basic S3 write permissions. The bucket policy must allow the CloudFront log delivery service principal - it’s different from your IAM user permissions. Also verify you’re not using SSE-KMS encryption on the bucket, as CloudFront can only write to buckets with SSE-S3 or no encryption. Check if your bucket has any restrictive policies that might block the AWS service account used for log delivery.

4

That’s definitely your problem - missing bucket policy. CloudFront can’t write logs without explicit permission granted to its service principal. You need to add a policy that allows the CloudFront log delivery account to put objects in your bucket.

5

Your issue is a missing S3 bucket policy that grants CloudFront permission to deliver logs. This is the most common cause of missing CloudFront access logs and requires addressing all three configuration areas.

S3 Bucket Policy for Log Delivery: CloudFront uses a specific AWS service account to write logs. Your bucket needs a policy granting PutObject and PutObjectAcl permissions to this account. Add this policy to your cdn-logs bucket:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowCloudFrontLogDelivery",
    "Effect": "Allow",
    "Principal": {
      "Service": "cloudfront.amazonaws.com"
    },
    "Action": [
      "s3:PutObject",
      "s3:PutObjectAcl"
    ],
    "Resource": "arn:aws:s3:::cdn-logs/*",
    "Condition": {
      "StringEquals": {
        "aws:SourceAccount": "YOUR_ACCOUNT_ID"
      }
    }
  }]
}

CloudFront Logging Configuration: Your configuration format needs correction. In the CloudFront console or API, specify only the bucket name without the .s3.amazonaws.com suffix:


Bucket for Logs: cdn-logs
Log Prefix: cloudfront/production/
Cookie Logging: Off (or On if needed)

The console adds the S3 domain automatically. Using cdn-logs.s3.amazonaws.com in configuration can cause routing issues where CloudFront attempts to resolve this as a custom domain.

Cross-Account Permissions (if applicable): If your CloudFront distribution and S3 bucket are in different AWS accounts, you need additional configuration:

  1. Bucket policy must reference the source account where CloudFront distribution exists
  2. Bucket ACLs should allow log delivery from CloudFront service
  3. Bucket ownership controls should allow ACL-based permissions

For same-account setup (your case), the bucket policy above is sufficient.

Additional Considerations:

  • Bucket cannot use SSE-KMS encryption (SSE-S3 or no encryption only)
  • Bucket must not have “Block all public access” preventing ACL-based permissions from AWS services
  • Log delivery typically begins within 1-2 hours after policy is applied, but can take up to 24 hours
  • Logs are delivered multiple times per hour in compressed .gz files

Verification Steps:

  1. Apply the bucket policy with your actual account ID
  2. Wait 2-4 hours for first log files to appear
  3. Check CloudFront metrics to confirm distribution is receiving traffic
  4. Verify bucket region matches CloudFront logging requirements (any region works, but us-east-1 is standard)

After applying this policy, logs should start appearing within a few hours. The combination of proper bucket policy permissions, corrected CloudFront configuration format, and appropriate cross-account settings (when needed) resolves all three focus areas preventing log delivery.

6

First thing to check - does your S3 bucket policy grant CloudFront log delivery permissions? CloudFront uses a specific AWS service principal that needs explicit write access. Without this, logs get dropped silently.

7

Beyond the bucket policy, double-check your CloudFront logging configuration format. The bucket name should be just the bucket name without .s3.amazonaws.com suffix in most configuration interfaces. Also, CloudFront logs can take up to several hours to appear initially, though 72 hours is definitely too long.

8

If you’re doing cross-account logging (CloudFront distribution in one account, S3 bucket in another), the permissions get more complex. You need both bucket policy and potentially bucket ACLs configured correctly for the CloudFront service account.