{
  "Provider": "aws",
  "CheckID": "cloudfront_distributions_logging_enabled",
  "CheckTitle": "Check if CloudFront distributions have logging enabled.",
  "CheckType": [],
  "ServiceName": "cloudfront",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
  "Severity": "medium",
  "ResourceType": "AwsCloudFrontDistribution",
  "Description": "Check if CloudFront distributions have logging enabled.",
  "Risk": "If not enabled monitoring of service use is not possible.",
  "RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html",
  "Remediation": {
    "Code": {
      "CLI": "https://docs.bridgecrew.io/docs/logging_20#cli-command",
      "NativeIaC": "https://docs.bridgecrew.io/docs/logging_20#cloudformation",
      "Other": "",
      "Terraform": "https://docs.bridgecrew.io/docs/logging_20#terraform"
    },
    "Recommendation": {
      "Text": "Real-time monitoring can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Enable logging for services with defined log rotation. These logs are useful for Incident Response and forensics investigation among other use cases.",
      "Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html"
    }
  },
  "Categories": [
    "forensics-ready"
  ],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": "Logging and Monitoring"
}
