Skip to main content

​
Overview

Send CloudFront access logs to your assigned Profound S3 destination to see agent traffic in Agent Analytics. This guide uses standard logging (v2), cross-account delivery, and SSE-S3 encryption.
Contact Profound support with your distribution ARN to receive your destination settings and delivery source name.
For the Firehose integration, see CloudFront through Amazon Data Firehose.

​
Prerequisites

  • Access to the AWS account that owns your CloudFront distribution.
  • Permission to configure CloudFront standard logging and CloudWatch Logs delivery resources.
  • An AWS CLI version that supports aws logs put-delivery-source and aws logs create-delivery, authenticated to that account.
  • Your CloudFront distribution ARN.

​
Encryption

This guide uses SSE-S3 (AES256) to encrypt your logs at rest with keys managed by Amazon S3. Profound configures encryption on your destination.

​
Configuration

1

Get your destination settings

Open your distribution in the CloudFront console and copy its ARN. Send it to Profound support. It identifies both your distribution and its AWS account:
Profound prepares the source record, S3 destination, and cross-account permissions. You will receive:The delivery destination ARN is a CloudWatch Logs resource ARN, not the S3 bucket ARN. Use all assigned values exactly as supplied.
2

Create the delivery source

Run this command in the AWS account that owns your distribution. Replace the placeholders with your assigned source name and distribution ARN:
Run CloudFront delivery commands in us-east-1, even though the destination bucket is in us-west-2.
Use the source name supplied by Profound so it matches the configured delivery permissions.
3

Connect to the Profound destination

After Profound confirms the destination is ready, create the delivery in your AWS account:
Keep the returned delivery ID for troubleshooting. This creates a delivery; do not rerun it to check status.Profound manages the receiving bucket policy and delivery destination policy. You do not need to create a destination bucket or share AWS access keys with Profound.
4

Keep the expected log format

Keep the default standard-log field selection. Profound’s destination uses W3C output: tab-separated records with a #Fields header in each file.The fields used for Agent Analytics include:Preserve x-host-header to identify the domain requested by the visitor. Do not change this destination to JSON or Parquet, remove the header, or replace tabs with spaces.Keep the assigned destination path. Coordinate any changes to fields or file paths with Profound before applying them.
5

Confirm delivery

Open your distribution’s Logging tab and confirm the S3 cross-account delivery appears. Generate traffic and allow time for logs to arrive.Ask Profound support to confirm receipt if you need to check the destination files. Access to your AWS account does not grant read access to Profound’s bucket.

​
Verify ingestion

Open Agent Analytics for your domain and select a date range covering your test requests. Confirm that expected agent traffic appears after delivery and processing. If data is missing, provide support with the distribution ARN, delivery source name, delivery ID, request time, and any AWS error. Do not include credentials.

​
Troubleshooting

​
Additional Resources