Json Yaml Access Logging Disabled Cloudfront
Description
Detects when AWS CloudFront distributions are configured without access logging enabled in CloudFormation templates. Lack of access logging prevents tracking of content delivery activities and user requests, which reduces security visibility and audit capabilities.
Detection Strategy
• Identifies CloudFormation resources of type 'AWS::CloudFront::Distribution'
• Checks if logging configuration is missing or disabled in the distribution properties
• Reports a vulnerability when a CloudFront distribution resource is found without an enabled logging configuration
Vulnerable code example
Resources:
myDistribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
DefaultCacheBehavior:
TargetOriginId: origin1
ForwardedValues:...✅ Secure code example
Resources:
myDistribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
DefaultCacheBehavior:
TargetOriginId: origin1
ForwardedValues:...Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.