AWS AmazonCloudFront medium security documentation change
Summary
Updated terminology from 'real-time logs' to 'real-time access logs' throughout the document for consistency. Added new 'connection-id' field documentation related to mTLS connections.
Security assessment
The addition of the 'connection-id' field (field 70) explicitly references mutual TLS (mTLS) authentication, which is a security feature. This provides documentation about logging TLS connection identifiers, which aids in security monitoring and auditing. The mTLS requirement indicates a direct security context.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.md b/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.md index 3eddc6720..08b1c0f55 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/real-time-logs.md +++ b//AmazonCloudFront/latest/DeveloperGuide/real-time-logs.md @@ -5 +5 @@ -Create and use real-time log configurationsUnderstand real-time log configurationsCreate a Kinesis Data Streams consumerTroubleshoot real-time logs +Create and use real-time access log configurationsUnderstand real-time access log configurationsCreate a Kinesis Data Streams consumerTroubleshoot real-time access logs @@ -7 +7 @@ Create and use real-time log configurationsUnderstand real-time log configuratio -# Use real-time logs +# Use real-time access logs @@ -9 +9 @@ Create and use real-time log configurationsUnderstand real-time log configuratio -With CloudFront real-time logs, you can get information about requests made to a distribution in real time (logs are delivered within seconds of receiving the requests). You can use real-time logs to monitor, analyze, and take action based on content delivery performance. +With CloudFront real-time access logs, you can get information about requests made to a distribution in real time (logs are delivered within seconds of receiving the requests). You can use real-time access logs to monitor, analyze, and take action based on content delivery performance. @@ -11 +11 @@ With CloudFront real-time logs, you can get information about requests made to a -CloudFront real-time logs are configurable. You can choose: +CloudFront real-time access logs are configurable. You can choose: @@ -13 +13 @@ CloudFront real-time logs are configurable. You can choose: - * The _sampling rate_ for your real-time logs—that is, the percentage of requests for which you want to receive real-time log records. + * The _sampling rate_ for your real-time logs—that is, the percentage of requests for which you want to receive real-time access log records. @@ -22 +22 @@ CloudFront real-time logs are configurable. You can choose: -CloudFront real-time logs are delivered to the data stream of your choice in Amazon Kinesis Data Streams. You can build your own [Kinesis data stream consumer](https://docs.aws.amazon.com/streams/latest/dev/amazon-kinesis-consumers.html), or use Amazon Data Firehose to send the log data to Amazon Simple Storage Service (Amazon S3), Amazon Redshift, Amazon OpenSearch Service (OpenSearch Service), or a third-party log processing service. +CloudFront real-time access logs are delivered to the data stream of your choice in Amazon Kinesis Data Streams. You can build your own [Kinesis data stream consumer](https://docs.aws.amazon.com/streams/latest/dev/amazon-kinesis-consumers.html), or use Amazon Data Firehose to send the log data to Amazon Simple Storage Service (Amazon S3), Amazon Redshift, Amazon OpenSearch Service (OpenSearch Service), or a third-party log processing service. @@ -24 +24 @@ CloudFront real-time logs are delivered to the data stream of your choice in Ama -CloudFront charges for real-time logs, in addition to the charges you incur for using Kinesis Data Streams. For more information about pricing, see [Amazon CloudFront Pricing](https://aws.amazon.com/cloudfront/pricing/) and [Amazon Kinesis Data Streams pricing](https://aws.amazon.com/kinesis/data-streams/pricing/). +CloudFront charges for real-time access logs, in addition to the charges you incur for using Kinesis Data Streams. For more information about pricing, see [Amazon CloudFront Pricing](https://aws.amazon.com/cloudfront/pricing/) and [Amazon Kinesis Data Streams pricing](https://aws.amazon.com/kinesis/data-streams/pricing/). @@ -28 +28 @@ CloudFront charges for real-time logs, in addition to the charges you incur for -We recommend that you use the logs to understand the nature of the requests for your content, not as a complete accounting of all requests. CloudFront delivers real-time logs on a best-effort basis. The log entry for a particular request might be delivered long after the request was actually processed and, in rare cases, a log entry might not be delivered at all. When a log entry is omitted from real-time logs, the number of entries in the real-time logs won't match the usage that appears in the AWS billing and usage reports. +We recommend that you use the logs to understand the nature of the requests for your content, not as a complete accounting of all requests. CloudFront delivers real-time access logs on a best-effort basis. The log entry for a particular request might be delivered long after the request was actually processed and, in rare cases, a log entry might not be delivered at all. When a log entry is omitted from real-time access logs, the number of entries in the real-time access logs won't match the usage that appears in the AWS billing and usage reports. @@ -32 +32 @@ We recommend that you use the logs to understand the nature of the requests for - * Create and use real-time log configurations + * Create and use real-time access log configurations @@ -34 +34 @@ We recommend that you use the logs to understand the nature of the requests for - * Understand real-time log configurations + * Understand real-time access log configurations @@ -38 +38 @@ We recommend that you use the logs to understand the nature of the requests for - * Troubleshoot real-time logs + * Troubleshoot real-time access logs @@ -43 +43 @@ We recommend that you use the logs to understand the nature of the requests for -## Create and use real-time log configurations +## Create and use real-time access log configurations @@ -45 +45 @@ We recommend that you use the logs to understand the nature of the requests for -To get information about requests made to a distribution in real time. you can use a real-time log configurations. Logs are delivered within seconds of receiving the requests. You can create a real-time log configuration in the CloudFront console, with the AWS Command Line Interface (AWS CLI), or with the CloudFront API. +To get information about requests made to a distribution in real time. you can use a real-time access log configurations. Logs are delivered within seconds of receiving the requests. You can create a real-time access log configuration in the CloudFront console, with the AWS Command Line Interface (AWS CLI), or with the CloudFront API. @@ -47 +47 @@ To get information about requests made to a distribution in real time. you can u -To use a real-time log configuration, you attach it to one or more cache behaviors in a CloudFront distribution. +To use a real-time access log configuration, you attach it to one or more cache behaviors in a CloudFront distribution. @@ -52 +52 @@ Console -###### To create a real-time log configuration +###### To create a real-time access log configuration @@ -64 +64 @@ Console - 6. For **Fields** , choose the fields to receive in the real-time logs. + 6. For **Fields** , choose the fields to receive in the real-time access logs. @@ -68 +68 @@ Console - 7. For **Endpoint** , choose one or more Kinesis data streams to receive real-time logs. + 7. For **Endpoint** , choose one or more Kinesis data streams to receive real-time access logs. @@ -72 +72 @@ Console -CloudFront real-time logs are delivered to the data stream that you specify in Kinesis Data Streams. To read and analyze your real-time logs, you can build your own Kinesis data stream consumer. You can also use Firehose to send the log data to Amazon S3, Amazon Redshift, Amazon OpenSearch Service, or a third-party log processing service. +CloudFront real-time access logs are delivered to the data stream that you specify in Kinesis Data Streams. To read and analyze your real-time access logs, you can build your own Kinesis data stream consumer. You can also use Firehose to send the log data to Amazon S3, Amazon Redshift, Amazon OpenSearch Service, or a third-party log processing service. @@ -76 +76 @@ CloudFront real-time logs are delivered to the data stream that you specify in K - 9. (Optional) For **Distribution** , choose a CloudFront distribution and cache behavior to attach to the real-time log configuration. + 9. (Optional) For **Distribution** , choose a CloudFront distribution and cache behavior to attach to the real-time access log configuration. @@ -83 +83 @@ CloudFront real-time logs are delivered to the data stream that you specify in K -If successful, the console shows the details of the real-time log configuration that you just created. +If successful, the console shows the details of the real-time access log configuration that you just created. @@ -85 +85 @@ If successful, the console shows the details of the real-time log configuration -For more information, see Understand real-time log configurations. +For more information, see Understand real-time access log configurations. @@ -90 +90 @@ AWS CLI -To create a real-time log configuration with the AWS CLI, use the **aws cloudfront create-realtime-log-config** command. You can use an input file to provide the command's input parameters, rather than specifying each individual parameter as command line input. +To create a real-time access log configuration with the AWS CLI, use the **aws cloudfront create-realtime-log-config** command. You can use an input file to provide the command's input parameters, rather than specifying each individual parameter as command line input. @@ -92 +92 @@ To create a real-time log configuration with the AWS CLI, use the **aws cloudfro -###### To create a real-time log configuration (CLI with input file) +###### To create a real-time access log configuration (CLI with input file) @@ -98 +98 @@ To create a real-time log configuration with the AWS CLI, use the **aws cloudfro - 2. Open the file named `rtl-config.yaml` that you just created. Edit the file to specify the real-time log configuration settings that you want, then save the file. Note the following: + 2. Open the file named `rtl-config.yaml` that you just created. Edit the file to specify the real-time access log configuration settings that you want, then save the file. Note the following: @@ -102 +102 @@ To create a real-time log configuration with the AWS CLI, use the **aws cloudfro -For more information about the real-time long configuration settings, see Understand real-time log configurations. +For more information about the real-time long configuration settings, see Understand real-time access log configurations. @@ -104 +104 @@ For more information about the real-time long configuration settings, see Unders - 3. Use the following command to create the real-time log configuration using input parameters from the `rtl-config.yaml` file. + 3. Use the following command to create the real-time access log configuration using input parameters from the `rtl-config.yaml` file. @@ -111 +111 @@ For more information about the real-time long configuration settings, see Unders -If successful, the command's output shows the details of the real-time log configuration that you just created. +If successful, the command's output shows the details of the real-time access log configuration that you just created. @@ -113 +113 @@ If successful, the command's output shows the details of the real-time log confi -###### To attach a real-time log configuration to an existing distribution (CLI with input file) +###### To attach a real-time access log configuration to an existing distribution (CLI with input file) @@ -119 +119 @@ If successful, the command's output shows the details of the real-time log confi - 2. Open the file named `dist-config.yaml` that you just created. Edit the file, making the following changes to each cache behavior that you are updating to use a real-time log configuration. + 2. Open the file named `dist-config.yaml` that you just created. Edit the file, making the following changes to each cache behavior that you are updating to use a real-time access log configuration. @@ -121 +121 @@ If successful, the command's output shows the details of the real-time log confi - * In the cache behavior, add a field named `RealtimeLogConfigArn`. For the field's value, use the ARN of the real-time log configuration that you want to attach to this cache behavior. + * In the cache behavior, add a field named `RealtimeLogConfigArn`. For the field's value, use the ARN of the real-time access log configuration that you want to attach to this cache behavior. @@ -127 +127 @@ Save the file when finished. - 3. Use the following command to update the distribution to use the real-time log configuration. Replace `distribution_ID` with the distribution's ID. + 3. Use the following command to update the distribution to use the real-time access log configuration. Replace `distribution_ID` with the distribution's ID. @@ -139 +139 @@ API -To create a real-time log configuration with the CloudFront API, use the [CreateRealtimeLogConfig](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateRealtimeLogConfig.html) API operation. For more information about the parameters that you specify in this API call, see Understand real-time log configurations and the API reference documentation for your AWS SDK or other API client. +To create a real-time access log configuration with the CloudFront API, use the [CreateRealtimeLogConfig](https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateRealtimeLogConfig.html) API operation. For more information about the parameters that you specify in this API call, see Understand real-time access log configurations and the API reference documentation for your AWS SDK or other API client. @@ -141 +141 @@ To create a real-time log configuration with the CloudFront API, use the [Create -After you create a real-time log configuration, you can attach it to a cache behavior, by using one of the following API operations: +After you create a real-time access log configuration, you can attach it to a cache behavior, by using one of the following API operations: @@ -150 +150 @@ After you create a real-time log configuration, you can attach it to a cache beh -For both of these API operations, provide the ARN of the real-time log configuration in the `RealtimeLogConfigArn` field, inside a cache behavior. For more information about the other fields that you specify in these API calls, see [All distribution settings reference](./distribution-web-values-specify.html) and the API reference documentation for your AWS SDK or other API client. +For both of these API operations, provide the ARN of the real-time access log configuration in the `RealtimeLogConfigArn` field, inside a cache behavior. For more information about the other fields that you specify in these API calls, see [All distribution settings reference](./distribution-web-values-specify.html) and the API reference documentation for your AWS SDK or other API client. @@ -152 +152 @@ For both of these API operations, provide the ARN of the real-time log configura -## Understand real-time log configurations +## Understand real-time access log configurations @@ -154 +154 @@ For both of these API operations, provide the ARN of the real-time log configura -To use CloudFront real-time logs, you start by creating a real-time log configuration. The real-time log configuration contains information about which log fields you want to receive, the _sampling rate_ for log records, and the Kinesis data stream where you want to deliver the logs. +To use CloudFront real-time access logs, you start by creating a real-time access log configuration. The real-time access log configuration contains information about which log fields you want to receive, the _sampling rate_ for log records, and the Kinesis data stream where you want to deliver the logs. @@ -156 +156 @@ To use CloudFront real-time logs, you start by creating a real-time log configur -Specifically, a real-time log configuration contains the following settings: +Specifically, a real-time access log configuration contains the following settings: @@ -175 +175 @@ Specifically, a real-time log configuration contains the following settings: -A name to identify the real-time log configuration. +A name to identify the real-time access log configuration. @@ -179 +179 @@ A name to identify the real-time log configuration. -The sampling rate is a whole number between 1 and 100 (inclusive) that determines the percentage of viewer requests that are sent to Kinesis Data Streams as real-time log records. To include every viewer request in your real-time logs, specify 100 for the sampling rate. You might choose a lower sampling rate to reduce costs while still receiving a representative sample of request data in your real-time logs. +The sampling rate is a whole number between 1 and 100 (inclusive) that determines the percentage of viewer requests that are sent to Kinesis Data Streams as real-time access log records. To include every viewer request in your real-time access logs, specify 100 for the sampling rate. You might choose a lower sampling rate to reduce costs while still receiving a representative sample of request data in your real-time access logs. @@ -183 +183 @@ The sampling rate is a whole number between 1 and 100 (inclusive) that determine -A list of the fields that are included in each real-time log record. Each log record can contain up to 40 fields, and you can choose to receive all of the available fields, or only the fields that you need for monitoring and analyzing performance. +A list of the fields that are included in each real-time access log record. Each log record can contain up to 40 fields, and you can choose to receive all of the available fields, or only the fields that you need for monitoring and analyzing performance. @@ -187 +187 @@ The following list contains each field name and a description of the information -Fields 46-63 are common media client data (CMCD) that media player clients can send to CDNs with each request. You can use this data to understand each request, such as the media type (audio, video), playback rate, and streaming length. These fields will only appear in your real-time logs if they're sent to CloudFront. +Fields 46-63 are common media client data (CMCD) that media player clients can send to CDNs with each request. You can use this data to understand each request, such as the media type (audio, video), playback rate, and streaming length. These fields will only appear in your real-time access logs if they're sent to CloudFront. @@ -505 +505 @@ The autonomous system number (ASN) of the viewer. - 47. ###### CMCD fields in real-time logs + 47. ###### CMCD fields in real-time access logs @@ -600,0 +601,6 @@ The ID of the distribution tenant. + 70. **`connection-id`** + +A unique identifier for the TLS connection. + +You must enable mTLS for your distributions before you can get information for this field. For more information, see [Mutual TLS (mTLS) viewer](./mtls-authentication.html). + @@ -627 +633 @@ You can use the [CloudFront usage reports](https://console.aws.amazon.com/cloudf - 2. Determine the typical size of a single real-time log record. + 2. Determine the typical size of a single real-time access log record. @@ -648 +654 @@ The pricing calculator shows you the number of shards you need and the estimated -The AWS Identity and Access Management (IAM) role that gives CloudFront permission to deliver real-time logs to your Kinesis data stream. +The AWS Identity and Access Management (IAM) role that gives CloudFront permission to deliver real-time access logs to your Kinesis data stream. @@ -650 +656 @@ The AWS Identity and Access Management (IAM) role that gives CloudFront permissi -When you create a real-time log configuration with the CloudFront console, you can choose **Create new service role** to let the console create the IAM role for you. +When you create a real-time access log configuration with the CloudFront console, you can choose **Create new service role** to let the console create the IAM role for you. @@ -652 +658 @@ When you create a real-time log configuration with the CloudFront console, you c -When you create a real-time log configuration with AWS CloudFormation or the CloudFront API (AWS CLI or SDK), you must create the IAM role yourself and provide the role ARN. To create the IAM role yourself, use the following policies. +When you create a real-time access log configuration with AWS CloudFormation or the CloudFront API (AWS CLI or SDK), you must create the IAM role yourself and provide the role ARN. To create the IAM role yourself, use the following policies. @@ -760 +766 @@ JSON -To read and analyze your real-time logs, you build or use a Kinesis Data Streams _consumer_. When you build a consumer for CloudFront real-time logs, it's important to know that the fields in every real-time log record are always delivered in the same order, as listed in the Fields section. Make sure that you build your consumer to accommodate this fixed order. +To read and analyze your real-time access logs, you build or use a Kinesis Data Streams _consumer_. When you build a consumer for CloudFront real-time logs, it's important to know that the fields in every real-time access log record are always delivered in the same order, as listed in the Fields section. Make sure that you build your consumer to accommodate this fixed order. @@ -762 +768 @@ To read and analyze your real-time logs, you build or use a Kinesis Data Streams -For example, consider a real-time log configuration that includes only these three fields: `time-to-first-byte`, `sc-status`, and `c-country`. In this scenario, the last field, `c-country`, is always field number 3 in every log record. However, if you later add fields to the real-time log configuration, the placement of each field in a record can change. +For example, consider a real-time access log configuration that includes only these three fields: `time-to-first-byte`, `sc-status`, and `c-country`. In this scenario, the last field, `c-country`, is always field number 3 in every log record. However, if you later add fields to the real-time access log configuration, the placement of each field in a record can change. @@ -764 +770 @@ For example, consider a real-time log configuration that includes only these thr -For example, if you add the fields `sc-bytes` and `time-taken` to the real-time log configuration, these fields are inserted into each log record according to the order shown in the Fields section. The resulting order of all five fields is `time-to-first-byte`, `sc-status`, `sc-bytes`, `time-taken`, and `c-country`. The `c-country` field was originally field number 3, but is now field number 5\. Make sure that your consumer application can handle fields that change position in a log record, in case you add fields to your real-time log configuration. +For example, if you add the fields `sc-bytes` and `time-taken` to the real-time access log configuration, these fields are inserted into each log record according to the order shown in the Fields section. The resulting order of all five fields is `time-to-first-byte`, `sc-status`, `sc-bytes`, `time-taken`, and `c-country`. The `c-country` field was originally field number 3, but is now field number 5\. Make sure that your consumer application can handle fields that change position in a log record, in case you add fields to your real-time access log configuration. @@ -766 +772 @@ For example, if you add the fields `sc-bytes` and `time-taken` to the real-time -## Troubleshoot real-time logs +## Troubleshoot real-time access logs @@ -768 +774 @@ For example, if you add the fields `sc-bytes` and `time-taken` to the real-time -After you create a real-time log configuration, you might find that no records (or not all records) are delivered to Kinesis Data Streams. In this case, you should first verify that your CloudFront distribution is receiving viewer requests. If it is, you can check the following setting to continue troubleshooting. +After you create a real-time access log configuration, you might find that no records (or not all records) are delivered to Kinesis Data Streams. In this case, you should first verify that your CloudFront distribution is receiving viewer requests. If it is, you can check the following setting to continue troubleshooting. @@ -773 +779 @@ After you create a real-time log configuration, you might find that no records ( -To deliver real-time log records to your Kinesis data stream, CloudFront uses the IAM role in the real-time log configuration. Make sure that the role trust policy and the role permissions policy match the policies shown in IAM role. +To deliver real-time access log records to your Kinesis data stream, CloudFront uses the IAM role in the real-time access log configuration. Make sure that the role trust policy and the role permissions policy match the policies shown in IAM role. @@ -778 +784 @@ To deliver real-time log records to your Kinesis data stream, CloudFront uses th -If CloudFront writes real-time log records to your Kinesis data stream faster than the stream can handle, Kinesis Data Streams might throttle the requests from CloudFront. In this case, you can increase the number of shards in your Kinesis data stream. Each shard can support writes up to 1,000 records per second, up to a maximum data write of 1 MB per second. +If CloudFront writes real-time access log records to your Kinesis data stream faster than the stream can handle, Kinesis Data Streams might throttle the requests from CloudFront. In this case, you can increase the number of shards in your Kinesis data stream. Each shard can support writes up to 1,000 records per second, up to a maximum data write of 1 MB per second.