> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryprofound.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon CloudFront

> Deliver CloudFront access logs to Profound through Amazon S3.

## Overview

Send CloudFront access logs to your assigned Profound S3 destination to see agent traffic in Agent Analytics. This guide uses standard logging (v2), cross-account delivery, and SSE-S3 encryption.

<Info>
  Contact [Profound support](mailto:support@tryprofound.com) with your distribution ARN to receive your destination settings and delivery source name.
</Info>

For the Firehose integration, see [CloudFront through Amazon Data Firehose](/agent-analytics/aws_firehose_cloudfront).

## Prerequisites

* Access to the AWS account that owns your CloudFront distribution.
* Permission to configure CloudFront standard logging and CloudWatch Logs delivery resources.
* An AWS CLI version that supports `aws logs put-delivery-source` and `aws logs create-delivery`, authenticated to that account.
* Your CloudFront distribution ARN.

## Encryption

This guide uses **SSE-S3 (AES256)** to encrypt your logs at rest with keys managed by Amazon S3. Profound configures encryption on your destination.

## Configuration

<Steps>
  <Step title="Get your destination settings">
    Open your distribution in the CloudFront console and copy its ARN. Send it to Profound support. It identifies both your distribution and its AWS account:

    ```text theme={null}
    arn:aws:cloudfront::<your-aws-account-id>:distribution/<distribution-id>
    ```

    Profound prepares the source record, S3 destination, and cross-account permissions. You will receive:

    | Setting                  | Purpose                                    |
    | ------------------------ | ------------------------------------------ |
    | Bucket and prefix        | Where Profound receives this source's logs |
    | Bucket region            | `us-west-2` (US West, Oregon)              |
    | Delivery source name     | The exact name to use in your AWS account  |
    | Delivery destination ARN | The Profound destination to connect to     |
    | Output format            | W3C, configured by Profound                |

    The delivery destination ARN is a CloudWatch Logs resource ARN, not the S3 bucket ARN. Use all assigned values exactly as supplied.
  </Step>

  <Step title="Create the delivery source">
    Run this command in the AWS account that owns your distribution. Replace the placeholders with your assigned source name and distribution ARN:

    ```bash theme={null}
    aws logs put-delivery-source \
      --region us-east-1 \
      --name '<assigned-delivery-source-name>' \
      --resource-arn 'arn:aws:cloudfront::<your-aws-account-id>:distribution/<distribution-id>' \
      --log-type ACCESS_LOGS
    ```

    <Note>
      Run CloudFront delivery commands in **`us-east-1`**, even though the destination bucket is in **`us-west-2`**.
    </Note>

    Use the source name supplied by Profound so it matches the configured delivery permissions.
  </Step>

  <Step title="Connect to the Profound destination">
    After Profound confirms the destination is ready, create the delivery in your AWS account:

    ```bash theme={null}
    aws logs create-delivery \
      --region us-east-1 \
      --delivery-source-name '<assigned-delivery-source-name>' \
      --delivery-destination-arn '<profound-delivery-destination-arn>'
    ```

    Keep the returned delivery ID for troubleshooting. This creates a delivery; do not rerun it to check status.

    Profound manages the receiving bucket policy and delivery destination policy. You do not need to create a destination bucket or share AWS access keys with Profound.
  </Step>

  <Step title="Keep the expected log format">
    Keep the default standard-log field selection. Profound's destination uses **W3C** output: tab-separated records with a `#Fields` header in each file.

    The fields used for Agent Analytics include:

    | Fields                                     | Used for                       |
    | ------------------------------------------ | ------------------------------ |
    | `date`, `time`                             | Request time                   |
    | `c-ip`, `x-forwarded-for`                  | Client address                 |
    | `x-host-header`                            | Requested domain               |
    | `cs(Host)`                                 | Distribution hostname fallback |
    | `cs-method`, `cs-uri-stem`, `cs-uri-query` | Requested resource             |
    | `cs(User-Agent)`, `cs(Referer)`            | Agent and referral analysis    |
    | `sc-status`, `sc-bytes`                    | Response details               |

    Preserve `x-host-header` to identify the domain requested by the visitor. Do not change this destination to JSON or Parquet, remove the header, or replace tabs with spaces.

    Keep the assigned destination path. Coordinate any changes to fields or file paths with Profound before applying them.
  </Step>

  <Step title="Confirm delivery">
    Open your distribution's **Logging** tab and confirm the S3 cross-account delivery appears. Generate traffic and allow time for logs to arrive.

    Ask Profound support to confirm receipt if you need to check the destination files. Access to your AWS account does not grant read access to Profound's bucket.
  </Step>
</Steps>

## Verify ingestion

Open Agent Analytics for your domain and select a date range covering your test requests. Confirm that expected agent traffic appears after delivery and processing.

If data is missing, provide support with the distribution ARN, delivery source name, delivery ID, request time, and any AWS error. Do not include credentials.

## Troubleshooting

| Problem                                         | What to check                                                                                   |
| ----------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| CreateDelivery reports AccessDenied             | Confirm your AWS permissions and ask Profound to check the destination policy for your account. |
| AWS cannot find the source or destination       | Use `us-east-1` and the exact supplied resource names and ARN.                                  |
| Delivery exists but no data appears             | Confirm source readiness, generate new requests, and check the Agent Analytics date range.      |
| Records cannot be processed                     | Confirm W3C output, a `#Fields` header, tab-separated records, and the expected fields.         |
| Traffic appears under the distribution hostname | Check that `x-host-header` is included and contains the requested domain.                       |

## Additional Resources

* [AWS: CloudFront standard logging (v2) and cross-account delivery](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/standard-logging.html)
* [CloudFront through Amazon Data Firehose](/agent-analytics/aws_firehose_cloudfront)
* [Contact Profound support](mailto:support@tryprofound.com)