Control: CloudFront distributions access logs should be enabled
Description
This control checks if AWS CloudFront distributions are configured to capture information from AWS Simple Storage Service (AWS S3) server access logs. This rule is non-compliant if a CloudFront distribution does not have logging configured.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cloudfront_distribution_logging_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cloudfront_distribution_logging_enabled --shareSQL
This control uses a named query:
select arn as resource, case when logging ->> 'Enabled' = 'true' then 'ok' else 'alarm' end as status, case when logging ->> 'Enabled' = 'true' then title || ' logging enabled.' else title || ' logging disabled.' end as reason , region, account_idfrom aws_cloudfront_distribution;