Setting up access logging for cloudfront using cloudformation template

Hi rePost-User-3213957,

Please go through the below steps once i hope it will helps you to resolve your issue.

Step-by-Step Guide

Create the S3 Bucket:

• Use a CloudFormation template to create the S3 bucket that will store CloudFront logs.

Attach a Bucket Policy:

• Add a bucket policy to the S3 bucket that allows the CloudFront service to write logs to it.

Create the CloudFront Distribution:

• Configure the CloudFront distribution to use the S3 bucket for logging.

Example CloudFormation Template

Here’s an example CloudFormation template that accomplishes these tasks:

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  CloudFrontLoggingBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub 'cloudfront-logs-${AWS::AccountId}'
      AccessControl: LogDeliveryWrite
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  CloudFrontLoggingBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref CloudFrontLoggingBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowCloudFrontServicePrincipal
            Effect: Allow
            Principal:
              Service: 'cloudfront.amazonaws.com'
            Action: 's3:PutObject'
            Resource: !Sub 'arn:aws:s3:::${CloudFrontLoggingBucket}/*'
            Condition:
              StringEquals:
                'AWS:SourceArn': !GetAtt CloudFrontDistribution.Arn

  CloudFrontDistribution:
    Type: 'AWS::CloudFront::Distribution'
    Properties:
      DistributionConfig:
        Origins:
          - Id: myS3Origin
            DomainName: !Sub '${SourceBucket}.s3.amazonaws.com'
            S3OriginConfig:
              OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${SourceBucketOriginAccessIdentity}'
        Enabled: true
        DefaultCacheBehavior:
          TargetOriginId: myS3Origin
          ViewerProtocolPolicy: redirect-to-https
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
        Logging:
          Bucket: !Sub '${CloudFrontLoggingBucket}.s3.amazonaws.com'
          IncludeCookies: false
          Prefix: 'my-cloudfront-logs/'

Explanation

S3 Bucket Creation:

• The CloudFrontLoggingBucket resource creates an S3 bucket with the specified name. The PublicAccessBlockConfiguration ensures that the bucket is not publicly accessible.

Bucket Policy:

• The CloudFrontLoggingBucketPolicy resource attaches a policy to the S3 bucket, allowing the CloudFront service to write logs to it. The Condition ensures that only CloudFront distributions with the specified ARN can write to the bucket.

CloudFront Distribution:

• The CloudFrontDistribution resource configures a CloudFront distribution and specifies the logging configuration to point to the S3 bucket.

Main Points:

Bucket Policy: Ensure the bucket policy correctly grants the cloudfront.amazonaws.com service principal permission to write to the S3 bucket.

Bucket Name and ARNs: Ensure that the bucket name and ARNs are correctly referenced in the template.

Logging Configuration: Ensure the Logging property in the CloudFront distribution configuration correctly specifies the S3 bucket name and log prefix.

Access Control List (ACL): The ACL LogDeliveryWrite grants the necessary permissions for log delivery.

Hello.

How about trying the following to enable the ACL of the S3 bucket?
I think you can use ACL by using "OwnershipControls".
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-ownershipcontrols.html

  S3BucketLogs:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: examplebucket-logs
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true