EINBLIQ.IO

Amazon CloudFront

CloudFront standard logging (v2) delivers access logs across AWS accounts into an S3 bucket we manage. With CloudFront, send CMCD as a query parameter.

Last checked

Values you receive from us

Value Used for
<DELIVERY_DESTINATION_ARN> Log delivery destination we create for your account
<AWS_REGION> Region of the destination bucket

How cross-account delivery works

CloudFront standard logging (v2) sends logs through Amazon CloudWatch Logs delivery. Because the bucket belongs to our AWS account, both accounts take part:

  1. You send us your AWS account ID and the distribution IDs to include.
  2. We create a delivery destination for our bucket, allow your account to deliver to it and send you <DELIVERY_DESTINATION_ARN>.
  3. You create a delivery source for each distribution and connect it to the destination.

AWS sets up cross-account deliveries through the AWS CLI or API rather than the CloudFront console. The CloudWatch Logs delivery APIs for CloudFront run in us-east-1.

Connect your distributions

For each distribution, create a delivery source and a delivery. We send you the exact commands with your values filled in.

Shell
aws logs put-delivery-source \
  --region us-east-1 \
  --name "einbliq-<DISTRIBUTION_ID>" \
  --resource-arn "arn:aws:cloudfront::<ACCOUNT_ID>:distribution/<DISTRIBUTION_ID>" \
  --log-type ACCESS_LOGS

aws logs create-delivery \
  --region us-east-1 \
  --delivery-source-name "einbliq-<DISTRIBUTION_ID>" \
  --delivery-destination-arn "<DELIVERY_DESTINATION_ARN>"

The log format and fields are set on our side when we create the destination. CloudFront records the full request URL including the query string (cs-uri-query), whether or not query strings are forwarded to your origin.

Send CMCD as a query parameter

CloudFront standard logs contain no request headers apart from fixed fields such as User-Agent and Referer. CMCD sent as CMCD-* headers therefore does not reach the log. Configure your players to send CMCD as a query parameter. Support for logging CMCD headers with CloudFront is in development.

Keep CMCD out of the cache key

The managed cache policy CachingOptimized includes no query strings in the cache key, so CMCD does not fragment the cache. If your distribution uses a policy that includes query strings, create a custom cache policy:

Setting Value
Query strings Include all query strings except
Excluded CMCD

Signed URLs

Check the delivery

Tell us when the deliveries are created. Because of CloudFront’s start-up delay, we confirm the first complete log files a few hours later and check that the CMCD query parameter is present.