Find CloudFront Distributions Without Access Logs

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListDistributionsAndDeliveries",
      "Effect": "Allow",
      "Action": ["cloudfront:ListDistributions", "logs:DescribeDeliverySources", "logs:DescribeDeliveries"],
      "Resource": "*"
    },
    {
      "Sid": "ReadDistributionConfig",
      "Effect": "Allow",
      "Action": "cloudfront:GetDistributionConfig",
      "Resource": "arn:aws:cloudfront::111122223333:distribution/*"
    },
    {
      "Sid": "ReadLogBucketOwnership",
      "Effect": "Allow",
      "Action": "s3:GetBucketOwnershipControls",
      "Resource": "arn:aws:s3:::*"
    }
  ]
}

// find-cloudfront-distributions-without-logging.ts
// Reports every CloudFront distribution with its access logging: standard logging (legacy) to S3 from the
// distribution config, standard logging (v2) from CloudWatch Logs delivery sources and deliveries in us-east-1,
// and real-time logs on the default cache behavior. Flags distributions with no access logs at all, v2 sources
// with no delivery, and legacy log buckets that have ACLs disabled. Report only: nothing is changed.
// Usage:
//   npx tsx find-cloudfront-distributions-without-logging.ts
import { CloudFrontClient, GetDistributionConfigCommand, paginateListDistributions } from "@aws-sdk/client-cloudfront";
import {
  CloudWatchLogsClient,
  paginateDescribeDeliveries,
  paginateDescribeDeliverySources,
} from "@aws-sdk/client-cloudwatch-logs";
import { S3Client, GetBucketOwnershipControlsCommand } from "@aws-sdk/client-s3";

// CloudFront is global, and standard logging (v2) is configured through the CloudWatch Logs API in us-east-1.
const cloudfront = new CloudFrontClient({ region: "us-east-1" });
const logs = new CloudWatchLogsClient({ region: "us-east-1" });
const s3 = new S3Client({ region: "us-east-1", followRegionRedirects: true });

interface Row {
  Distribution: string;
  Domain: string;
  Enabled: string;
  LegacyS3: string;
  V2Destinations: string;
  RealTime: string;
  Finding: string;
}

const DEST_LABEL: Record<string, string> = { CWL: "CloudWatch Logs", S3: "S3", FH: "Firehose" };

const errText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

// Legacy logging stores the bucket as "amzn-s3-demo-bucket.s3.amazonaws.com".
const bucketName = (domain: string): string => domain.replace(/\.s3[.-][a-z0-9.-]*amazonaws\.com$/, "");

const ownershipCache = new Map<string, string>();
async function objectOwnership(bucket: string): Promise<string> {
  const cached = ownershipCache.get(bucket);
  if (cached) return cached;
  let result: string;
  try {
    const out = await s3.send(new GetBucketOwnershipControlsCommand({ Bucket: bucket }));
    result = out.OwnershipControls?.Rules?.[0]?.ObjectOwnership ?? "?";
  } catch (err) {
    const status = (err as { $metadata?: { httpStatusCode?: number } }).$metadata?.httpStatusCode;
    const name = err instanceof Error ? err.name : "";
    // No ownership controls on an older bucket means ACLs are still enabled (ObjectWriter behaviour).
    if (status === 404 && name !== "NoSuchBucket") result = "none set";
    else result = `unknown (${name || status})`;
  }
  ownershipCache.set(bucket, result);
  return result;
}

async function main(): Promise<void> {
  // Standard logging (v2): one delivery source per distribution, with zero or more deliveries.
  const sourceByArn = new Map<string, string>();
  for await (const page of paginateDescribeDeliverySources({ client: logs }, {})) {
    for (const src of page.deliverySources ?? []) {
      if (src.service !== "cloudfront" || src.logType !== "ACCESS_LOGS" || !src.name) continue;
      for (const arn of src.resourceArns ?? []) sourceByArn.set(arn, src.name);
    }
  }
  const destinationsBySource = new Map<string, string[]>();
  for await (const page of paginateDescribeDeliveries({ client: logs }, {})) {
    for (const d of page.deliveries ?? []) {
      if (!d.deliverySourceName) continue;
      const list = destinationsBySource.get(d.deliverySourceName) ?? [];
      list.push(DEST_LABEL[d.deliveryDestinationType ?? ""] ?? d.deliveryDestinationType ?? "?");
      destinationsBySource.set(d.deliverySourceName, list);
    }
  }

  const rows: Row[] = [];
  for await (const page of paginateListDistributions({ client: cloudfront }, {})) {
    for (const dist of page.DistributionList?.Items ?? []) {
      if (!dist.Id || !dist.ARN) continue;
      const findings: string[] = [];
      const cfg = await cloudfront.send(new GetDistributionConfigCommand({ Id: dist.Id }));
      const legacy = cfg.DistributionConfig?.Logging;
      let legacyText = "off";
      if (legacy?.Enabled && legacy.Bucket) {
        const bucket = bucketName(legacy.Bucket);
        const ownership = await objectOwnership(bucket);
        legacyText = `${bucket}/${legacy.Prefix ?? ""}`;
        if (ownership === "BucketOwnerEnforced") findings.push("legacy bucket has ACLs disabled: no log delivery");
        else if (ownership.startsWith("unknown")) findings.push(`legacy bucket ownership ${ownership}`);
      }
      const source = sourceByArn.get(dist.ARN);
      const destinations = source ? destinationsBySource.get(source) ?? [] : [];
      if (source && !destinations.length) findings.push("v2 source has no delivery");
      const realTime = dist.DefaultCacheBehavior?.RealtimeLogConfigArn ? "default behavior" : "-";
      if (legacyText === "off" && !destinations.length) {
        findings.unshift(dist.Enabled ? "NO ACCESS LOGS" : "no access logs (distribution disabled)");
      }
      rows.push({
        Distribution: dist.Id,
        Domain: dist.Aliases?.Items?.[0] ?? dist.DomainName ?? "?",
        Enabled: dist.Enabled ? "yes" : "no",
        LegacyS3: legacyText,
        V2Destinations: destinations.join(", ") || (source ? "source only" : "-"),
        RealTime: realTime,
        Finding: findings.join("; ") || "ok",
      });
    }
  }
  console.table(rows);
  const none = rows.filter((r) => r.Finding.startsWith("NO ACCESS LOGS"));
  console.log(
    `${rows.length} distributions: ${none.length} enabled without access logs, ` +
      `${rows.filter((r) => r.LegacyS3 !== "off").length} using standard logging (legacy), ` +
      `${rows.filter((r) => r.V2Destinations !== "-" && r.V2Destinations !== "source only").length} using standard logging (v2).`,
  );
  console.log("Report only: nothing was changed.");
}

main().catch((err) => {
  console.error(errText(err));
  process.exit(1);
});

npm install @aws-sdk/client-cloudfront @aws-sdk/client-cloudwatch-logs @aws-sdk/client-s3
npm install --save-dev tsx typescript @types/node

AWS_PROFILE=readonly npx tsx find-cloudfront-distributions-without-logging.ts

┌─────────┬──────────────────┬─────────────────────────────────┬─────────┬──────────────────────────────┬───────────────────────┬────────────────────┬────────────────────────────────────────────────────┐
│ (index) │ Distribution     │ Domain                          │ Enabled │ LegacyS3                     │ V2Destinations        │ RealTime           │ Finding                                            │
├─────────┼──────────────────┼─────────────────────────────────┼─────────┼──────────────────────────────┼───────────────────────┼────────────────────┼────────────────────────────────────────────────────┤
│ 0       │ 'E1A2B3C4D5E6F7' │ 'www.example.com'               │ 'yes'   │ 'amzn-s3-demo-logs/www/'     │ '-'                   │ '-'                │ 'ok'                                               │
│ 1       │ 'E2B3C4D5E6F7G8' │ 'api.example.com'               │ 'yes'   │ 'amzn-s3-demo-new-logs/api/' │ '-'                   │ '-'                │ 'legacy bucket has ACLs disabled: no log delivery' │
│ 2       │ 'E3C4D5E6F7G8H9' │ 'static.example.com'            │ 'yes'   │ 'off'                        │ 'CloudWatch Logs, S3' │ '-'                │ 'ok'                                               │
│ 3       │ 'E4D5E6F7G8H9I0' │ 'media.example.com'             │ 'yes'   │ 'off'                        │ 'source only'         │ 'default behavior' │ 'NO ACCESS LOGS; v2 source has no delivery'        │
│ 4       │ 'E5E6F7G8H9I0J1' │ 'e5e6f7g8h9i0j1.cloudfront.net' │ 'no'    │ 'off'                        │ '-'                   │ '-'                │ 'no access logs (distribution disabled)'           │
└─────────┴──────────────────┴─────────────────────────────────┴─────────┴──────────────────────────────┴───────────────────────┴────────────────────┴────────────────────────────────────────────────────┘
5 distributions: 1 enabled without access logs, 2 using standard logging (legacy), 1 using standard logging (v2).
Report only: nothing was changed.