AWS AmazonCloudFront documentation change
Summary
Updated documentation for Lambda@Edge and CloudFront Functions logging, including clarifications on log group naming, region handling, and error logging details. Minor grammatical improvements and consistency updates.
Security assessment
The changes are primarily editorial improvements and clarifications about logging behavior. There is no mention of security vulnerabilities, fixes, or new security features.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/edge-functions-logs.md index 9ce7b0e71..546ab09fa 100644 --- a/AmazonCloudFront/latest/DeveloperGuide/edge-functions-logs.md +++ b/AmazonCloudFront/latest/DeveloperGuide/edge-functions-logs.md @@ -26 +26 @@ We recommend that you use the logs to understand the nature of the requests for -Lambda@Edge automatically sends function logs to CloudWatch Logs, creating log streams in the AWS Regions where the functions are run. The log group name is formatted as `/aws/lambda/us-east-1.`function-name``, where ``function-name`` is the name that you gave to the function when you created it, and `us-east-1` is the Region code for the AWS Region where the function was created. The log group name always contains `us-east-1`, even for log groups for other Regions that your function runs in. +Lambda@Edge automatically sends function logs to CloudWatch Logs, creating log streams in the AWS Regions where the functions are invoked. The log group name is formatted as `/aws/lambda/us-east-1.`function-name``. The ``function-name`` is the name that you specified when you created the function, and `us-east-1` is the Region code for the where the function was created. The log group name always contains `us-east-1`, even for log groups in other Regions where your function is invoked. @@ -32 +32 @@ Lambda@Edge throttles logs based on the request volume and the size of logs. -You must review CloudWatch log files in the correct AWS Region to see your Lambda@Edge function log files. To see the Regions where your Lambda@Edge function is running, view graphs of metrics for the function in the CloudFront console. Metrics are displayed for each AWS Region. On the same page, you can choose a Region and then view log files for that Region to investigate issues. +You must review CloudWatch log files in the correct Region to see your Lambda@Edge function log files. To see the Regions where your Lambda@Edge function is running, view graphs of metrics for the function in the CloudFront console. Metrics are displayed for each Region. On the same page, you can choose a Region and then view log files for that Region to investigate issues. @@ -34 +34 @@ You must review CloudWatch log files in the correct AWS Region to see your Lambd -To learn more about how to use CloudWatch Logs with Lambda@Edge functions, see the following: +To learn more about how to use CloudWatch Logs with Lambda@Edge functions, see the following topics: @@ -62 +62 @@ The following shows an example log message sent to CloudWatch Logs. Each line be -CloudFront Functions sends logs to CloudWatch only for functions in the `LIVE` stage that run in response to production requests and responses. When you [test a function](./test-function.html), CloudFront doesn't send any logs to CloudWatch. The test output contains information about errors, compute utilization, and function logs (`console.log()` statements), but this information is not sent to CloudWatch. +CloudFront Functions sends logs to CloudWatch only for functions in the `LIVE` stage that run in response to production requests and responses. When you [test a function](./test-function.html), CloudFront doesn't send any logs to CloudWatch. The test output contains information about errors, compute utilization, and function logs (`console.log()` statements), but this information isn't sent to CloudWatch. @@ -64 +64 @@ CloudFront Functions sends logs to CloudWatch only for functions in the `LIVE` s -CloudFront Functions uses an AWS Identity and Access Management (IAM) [service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role) to send logs to CloudWatch Logs in your account. A service-linked role is an IAM role that is linked directly to an AWS service. Service-linked roles are predefined by the service and include all of the permissions that the service requires to call other AWS services on your behalf. CloudFront Functions uses a service-linked role called **AWSServiceRoleForCloudFrontLogger**. For more information about this role, see [Service-linked roles for Lambda@Edge](./lambda-edge-permissions.html#using-service-linked-roles-lambda-edge) (Lambda@Edge uses the same service-linked role). +CloudFront Functions uses an AWS Identity and Access Management (IAM) [service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role) to send logs to CloudWatch Logs in your account. A service-linked role is an IAM role that is linked directly to an AWS service. Service-linked roles are predefined by the service and include all of the permissions that the service requires to call other AWS services for you. CloudFront Functions uses the **AWSServiceRoleForCloudFrontLogger** service-linked role. For more information about this role, see [Service-linked roles for Lambda@Edge](./lambda-edge-permissions.html#using-service-linked-roles-lambda-edge) (Lambda@Edge uses the same service-linked role). @@ -66 +66 @@ CloudFront Functions uses an AWS Identity and Access Management (IAM) [service-l -When a function fails with a validation error or an execution error, information is logged in CloudFront's [standard logs](./AccessLogs.html) and [real-time logs](./real-time-logs.html). Information about the error is logged in the `x-edge-result-type`, `x-edge-response-result-type`, and `x-edge-detailed-result-type` fields. +When a function fails with a validation error or an execution error, the information is logged in [standard logs](./AccessLogs.html) and [real-time logs](./real-time-logs.html). For specific information about the error, see the `x-edge-result-type`, `x-edge-response-result-type`, and `x-edge-detailed-result-type` fields.