Getting Started

AWS CloudFront Standard Logs

Upload the Honeylog AWS template, create the CloudFormation stack, and verify delivery.

Use this guide when AWS CloudFront serves the website. Honeylog provides a template file that creates and connects the required AWS resources for you; you do not need to edit that file. AWS calls the group of resources created from the template a stack.

#Before you open AWS

Sign in to the AWS account that owns the CloudFront distribution for this website. Your account must be allowed to create CloudFormation stacks. If you cannot create one, send this guide and the downloaded Honeylog template to your AWS administrator.

#Step 1: Download the Honeylog AWS template

  1. Create the website in Honeylog and choose AWS CloudFront.
  2. In AWS, open CloudFront > Distributions and copy the value in the ID column for this website. Paste it into Honeylog.
  3. Download the Honeylog AWS template.

Before continuing, confirm that a file named cloudformation.yaml has been downloaded to your computer.

Download cloudformation.yaml

The public download above is a reference template and contains placeholders. For the actual installation, use the prefilled download from the private Honeylog installation page.

#Step 2: Create the stack in AWS

  1. In the AWS console search bar, search for CloudFormation and open it.
AWS console search result for CloudFormation
Search for CloudFormation in the AWS console and open the service.
  1. Click Create stack, then choose With new resources (standard).
CloudFormation Create stack menu with With new resources selected
Click Create stack and choose With new resources (standard).
  1. Under Prepare template, choose Choose an existing template.
  2. Under Specify template, choose Upload a template file.
  3. Choose the template downloaded from Honeylog.
CloudFormation template upload screen with Choose an existing template and Upload a template file selected
Choose an existing template, upload the Honeylog cloudformation.yaml file, then continue.
  1. Set a stack name that makes the website easy to recognize, such as honeylog-example-com.
  2. Review the prefilled parameters. They should match the CloudFront distribution and website selected in Honeylog; do not replace them with the placeholders from this public guide.
CloudFormation stack details form with Honeylog parameters
Review the stack name and Honeylog parameters before moving to the next step.
  1. Leave the stack options unchanged unless your AWS administrator has given you different instructions.
  2. Review the stack. When AWS asks for permission to create IAM resources, select the acknowledgement and create the stack. IAM resources are the AWS permissions used by the Honeylog components created by this template.
  3. Stay on the stack page until its status changes to CREATE_COMPLETE. Do not continue while it shows CREATE_IN_PROGRESS.

CREATE_COMPLETE is the result required before moving to Step 3. If AWS shows CREATE_FAILED, open the failed event in the stack and send its error message to your AWS administrator or Honeylog support.

CloudFormation parameters:

DistributionId: CLOUDFRONT_DISTRIBUTION_ID
HoneylogApiUrl: https://api.honeylog.io/events
HoneylogIngestionSecret: SITE_TOKEN
HoneylogSiteDomain: SITE_DOMAIN
ExistingDeliverySourceName: ""
SkipPathRegex: "\\.(?:css|js|mjs|map|png|jpe?g|gif|svg|ico|webp|avif|woff2?|ttf|eot|otf|xml|txt)$"

#Step 3: Verify delivery

  1. Open several public pages through the website domain served by CloudFront.
  2. Wait a few minutes, then open the Honeylog website view and look for the new visits.
  3. If the visits appear, the installation is complete.
  4. If they do not appear, open the CloudFormation stack and select the Outputs tab.
  5. Copy AccessLogGroupName, then open CloudWatch in the same AWS Region as the stack. Go to Logs > Log groups, search for that name, and confirm that new access records appear when pages are visited.
  6. Copy ConsumerFunctionName from the stack outputs. In CloudWatch, open the log group named /aws/lambda/ConsumerFunctionName and check for recent errors.
  7. Send any error message you find to your AWS administrator or Honeylog support.

Events can take a few minutes to appear. If AWS says that logging cannot be enabled for the distribution, the AWS administrator must remove that restriction before the Honeylog stack can be created successfully.