Configure an S3 Bucket for CloudFront Access Logs

CloudFront can log every request to an S3 bucket. The bucket must exist first, must have ACLs enabled (legacy ACL required by CloudFront), and must grant the CloudFront logging service account write access. Once set up, paste the bucket's S3 domain into "logBucket".

Paste into this field

CloudFront → logBucket

Output looks like

my-cf-logs.s3.amazonaws.com

1Create a dedicated logging bucket

Navigate to S3 → "Create bucket". Give it a unique name (e.g. my-app-cf-logs). Choose the same region as your stack (CloudFront writes from its edge, so region matters less, but keep it tidy).

3Enable ACLs on the bucket

In the bucket creation wizard under "Object Ownership", select "ACLs enabled" and choose "Bucket owner preferred". CloudFront uses a legacy ACL grant to write logs — without this the logs delivery will silently fail.

5Create the bucket

Leave all other defaults and click "Create bucket".

7Copy the bucket domain

Click into the bucket → Properties tab → scroll to "Bucket overview". The domain is: BUCKET-NAME.s3.amazonaws.com

9Paste into CloudStack Canvas

Select your CloudFront node → property panel → paste the domain (e.g. my-app-cf-logs.s3.amazonaws.com) into "Access Log Bucket".

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide