Where are our cloudfront links used?

Question

Hello guys,

a year ago, we've uploaded some product images to a s3 bucket and activated cloudfront to have some nice custom URLs like `cdn.ourdomain.com` instead of the standard s3 link `https://xyz.s3.eu-central-1.amazonaws.com/packshots/jpg/000025.jpg`
We than send the links to customers, that they can download the product images and upload them on their own server. Half year ago, we decided to switch from cloudfront links to the standard s3 links, as we didn't want to pay extra fee for the traffic.
Last week I've checked the cache statistics of our cloudfront distribution and realized that we still have massive traffic on cloudfront links. So that means, at least one of customers still use the cloudfront links instead of the s3 bucket links. I think, the cloudfront links are embedded in a website or something like this.

Question, how can I find out, if and where our cloudfront links are used?

Best regards
Ramin

Thanniru Anil Kumar · Accepted Answer

**CloudFront Logs:**

**Enable CloudFront Access Logs: **If you haven’t already, enable CloudFront access logging. This will create logs in an S3 bucket containing details of each request made to your CloudFront distribution.

**Analyze Logs:** Download and analyze the logs to identify the IP addresses, referrers, or domains making requests to your CloudFront distribution. Tools like Amazon Athena can be used to query these logs easily.

**2. CloudFront Usage Reports:**

**AWS CloudFront Usage Reports:** In the AWS Management Console, you can view usage reports under CloudFront’s “Reports and Analytics” section. These reports can show you which URLs are being accessed and the amount of traffic generated.

**3. Check Referrer Headers:**

Look at Referrer Information: Referrer headers in your CloudFront logs can tell you which websites are referring to your CloudFront links. This could help you identify where the links are embedded.

AWS Athena Query: Use Athena to query your CloudFront logs for referrer information. For example:

```
SELECT cs(Referer), count(*) 
FROM cloudfront_logs 
WHERE uri LIKE '%your-cloudfront-link%'
GROUP BY cs(Referer)

```
**search Engines and Tools:**
Reverse Search: Perform a reverse image search (for image links) using Google or other search engines to see if the images hosted on CloudFront are embedded in public websites.

**Web Crawlers:** Use tools like Screaming Frog SEO Spider or other web crawlers to scan the internet for links to your CloudFront URLs.

**5. Contact Customers:**
Reach Out to Customers: If possible, contact your customers who received the CloudFront links and ask if they are still using them. This can help you pinpoint where the traffic is coming from.

**6. Monitor DNS Requests (Optional):**

DNS Logs: If you manage your own DNS servers, check the DNS logs to see which IPs are resolving the cdn.ourdomain.com domain, which can give insight into who is accessing the CloudFront distribution.

https://repost.aws/knowledge-center/cloudfront-https-requests-s3

Where are our cloudfront links used?

Add your answer

Relevant content