CloudFront distribution should have access logging configured

What it checks

CloudFront distribution: access logging is not configured.

Where it applies

Terraform: aws_cloudfront_distribution

CloudFormation: AWS::CloudFront::Distribution

How to fix it

1. Add a logging_config block pointing to a dedicated S3 log bucket with a lifecycle policy. Cookie logging is optional and independent of cookie forwarding and cache-key selection; enable it only after deliberately reviewing the logged values and their access and retention controls.

Frameworks

• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules