Skip to content
AWS CloudFront Integration

AWS CloudFront Integration

Stream CloudFront access logs to Airefs in near real time using Amazon Data Firehose — no code changes to your application.

Updated
Ask AI
Ask ChatGPTAsk Claude
View as Markdown

CloudFront delivers access logs to an Amazon Data Firehose stream, and Firehose forwards them to Airefs over HTTPS. Airefs classifies bots versus humans and drops assets and error responses server-side, so send all traffic. This integration powers AI Impressions; to also track Clicks, add the client-side tracking script from Site Settings → Tracking Script.

Your access token is in your Airefs account under Site Settings → Access Token.

Step 1: Create the Firehose stream

  1. Switch the AWS console to US East (N. Virginia), us-east-1. CloudFront only supports Firehose logging destinations in this region.
  2. Open Amazon Data Firehose and click Create Firehose stream.
  3. Source: Direct PUT. Destination: HTTP Endpoint.
  4. HTTP endpoint URL:
https://api.getairefs.com/v1/logs/cloudfront
  1. Access key: paste your Airefs access token. If you use AWS Secrets Manager instead, the secret value must be exactly:
{"api_key": "YOUR_ACCESS_TOKEN"}
  1. Content encoding: enable GZIP.
  2. Set the buffer size to 4 MiB so the encoded delivery stays within Airefs’s ingestion limit.
  3. Backup settings: choose an S3 bucket for failed deliveries, then create the stream.

Step 2: Point CloudFront logging at the stream

  1. Open your CloudFront distribution and go to Logging.
  2. Click Add and choose delivery to your new Firehose stream.
  3. Output format: JSON.

  4. Select these fields: timestamp(ms), c-ip, sc-status, cs-method, cs-uri-stem, cs-uri-query, x-edge-request-id, x-host-header, cs(User-Agent), cs(Referer), sc-content-type, and optionally c-country.

  5. Save.

Verification

Firehose buffers and delivers in batches, so allow a few minutes after traffic reaches CloudFront for events to appear in your Airefs dashboard.

Deliveries failing? Objects in the S3 backup bucket contain the error: a 401 means the access key does not match your Airefs access token, and “records could not be decoded” means the output format is not JSON or a required field (most often x-edge-request-id or cs-uri-stem) is missing from the selection. The console’s “Test with demo data” fails by design — demo records are not CloudFront logs; a real page visit is the correct end-to-end test. Need help? Email support@getairefs.com.