---
title: "AWS CloudFront Integration"
description: "Stream CloudFront access logs to Airefs in near real time using Amazon Data Firehose — no code changes to your application."
---

> Documentation Index
> Fetch the complete documentation index at: /llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudFront Integration

CloudFront delivers access logs to an Amazon Data Firehose stream, and Firehose forwards them to Airefs over HTTPS. Airefs classifies bots versus humans and drops assets and error responses server-side, so send all traffic. This integration powers [AI Impressions](/docs/impressions/); to also track [Clicks](/docs/clicks/), add the client-side tracking script from **Site Settings → Tracking Script**.

Your access token is in your Airefs account under **Site Settings → Access Token**.

## Step 1: Create the Firehose stream

1.  Switch the AWS console to **US East (N. Virginia), `us-east-1`**. CloudFront only supports Firehose logging destinations in this region.
2.  Open **Amazon Data Firehose** and click **Create Firehose stream**.
3.  Source: **Direct PUT**. Destination: **HTTP Endpoint**.
4.  HTTP endpoint URL:

```text
https://api.getairefs.com/v1/logs/cloudfront
```

5.  Access key: paste your Airefs access token. If you use AWS Secrets Manager instead, the secret value must be exactly:

```json
{"api_key": "YOUR_ACCESS_TOKEN"}
```

6.  Content encoding: enable **GZIP**.
7.  Set the buffer size to **4 MiB** so the encoded delivery stays within Airefs’s ingestion limit.
8.  Backup settings: choose an S3 bucket for failed deliveries, then create the stream.

## Step 2: Point CloudFront logging at the stream

1.  Open your CloudFront distribution and go to **Logging**.
2.  Click **Add** and choose delivery to your new Firehose stream.
3.  Output format: **JSON**.
4.  Select these fields: `timestamp(ms)`, `c-ip`, `sc-status`, `cs-method`, `cs-uri-stem`, `cs-uri-query`, `x-edge-request-id`, `x-host-header`, `cs(User-Agent)`, `cs(Referer)`, `sc-content-type`, and optionally `c-country`.

5.  Save.

## Verification

Firehose buffers and delivers in batches, so allow a few minutes after traffic reaches CloudFront for events to appear in your Airefs dashboard.

Deliveries failing? Objects in the S3 backup bucket contain the error: a `401` means the access key does not match your Airefs access token, and “records could not be decoded” means the output format is not JSON or a required field (most often `x-edge-request-id` or `cs-uri-stem`) is missing from the selection. The console’s “Test with demo data” fails by design — demo records are not CloudFront logs; a real page visit is the correct end-to-end test. Need help? Email [support@getairefs.com](mailto:support@getairefs.com).

Source: /docs/integrations/cloudfront/