CloudFront log delivery to S3 works via Console but fails with CLI and Terraform (AccessDenied)

The issue you're experiencing is related to how CloudFront handles permissions for log delivery to S3 buckets when configured programmatically versus through the console.

When you enable CloudFront logging through the console, CloudFront automatically updates the bucket's ACL to give the awslogsdelivery account FULL_CONTROL permission to write logs to your bucket. However, when using CLI or Terraform, you need to ensure that:

1. Your IAM role has the necessary permissions to modify the bucket ACL (s3:GetBucketAcl and s3:PutBucketAcl).

2. The S3 bucket must have ACLs enabled. If you're using the "Bucket owner enforced" setting for S3 Object Ownership (which disables ACLs), CloudFront cannot write logs to the bucket.

CloudFront uses a different permissions model than other AWS services that send logs to S3. While your bucket policy correctly grants the cloudfront.amazonaws.com service principal the s3:PutObject permission, CloudFront specifically requires ACL permissions rather than just bucket policy permissions.

To fix this issue:

1. Make sure ACLs are enabled on your S3 bucket by checking the Object Ownership setting (it should be "Bucket owner preferred" or "Object writer" instead of "Bucket owner enforced").

2. Ensure your IAM role has the s3:GetBucketAcl and s3:PutBucketAcl permissions.

3. If you're using standard logging (v2), consider following the cross-account logging setup which uses the delivery.logs.amazonaws.com service principal instead.

The console handles these ACL modifications automatically, which is why it works there but fails when using CLI or Terraform.
Sources
Access control in Amazon S3 - Amazon Simple Storage Service
Configure standard logging (legacy) - Amazon CloudFront
Logs sent to Amazon S3 - Amazon CloudWatch Logs
Send CloudFront logs to an S3 bucket in another account | AWS re:Post

hi,

This is a complex scenario, while you have done configuration for both side terraform and s3 bucket policy right, as per the docs, I see.

as accessdiend is basically policies and configuration issues.

here in your situation access denied issue is

An error occurred (AccessDenied) when calling the UpdateDistribution operation: You don't have permission to access the S3 bucket for CloudFront logs: <your-bucket-name>.s3.amazonaws.com If you're using IAM, you need s3:GetBucketAcl and s3:PutBucketAcl permissions to create a distribution or to update log settings for an existing distribution. In addition, the S3 ACL for the bucket must grant you FULL_CONTROL.

as error says "You don't have permission to access the S3 bucket for CloudFront logs"

so, in my understanding S3 bucket policy is denying,

Your original bucket policy with the s3:x-amz-acl condition is technically correct, **but **if you can temporarily remove this condition, and rely on the ACLs and Object Ownership (which are necessary anyway) to enforce the delivery, thereby satisfying the API's less restrictive check during the update operation.

temporarily removing the condition and see if it works?

Best,

Hi again,

As per my understanding from the docs

When using: object_ownership = "BucketOwnerPreferred"

Terraform applies the ACL log-delivery-write, which grants access to the S3 Log Delivery group, not to the CloudFront canonical user.

However, CloudFront requires permissions for its own canonical user ID, which is different from the “log-delivery-write” group.

[https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudfront_log_delivery_canonical_user_id]()

OR

switching to BucketOwnerEnforced solves the issue without needing the CloudFront canonical user ID, since ACLs are disabled entirely. and remove the condition "s3:x-amz-acl": "bucket-owner-full-control" because ACLs are disabled in this mode.

This is my current understanding I faced a similar issue using CloudFormation last year

make sure the bucket name matches the actual S3 bucket name (not ARN)

Best

thanks for sharing your testing scenarios.

Here is a scenario I used with my existing CloudFront distribution, sending logs to a newly created S3 bucket using Terraform. I also included my CLI output for verification.

google docs created for this scenario: https://docs.google.com/document/d/e/2PACX-1vT81wh3algLi8vRWxzINZUGYIrMWiR-7UorjkcOooqsEUj4ehIrn0Hrso7UiTdG3sWvK3LOzo5Cq_eA/pub

After running the CLI linking command, I waited a few minutes for the logs to populate, and it worked. Output shows:

malini@Malini:~/projects/cloudfront-logging-demo$ aws cloudfront get-distribution --id EO9YJD19H7YWS --query 'Distribution.DistributionConfig.Logging'
{
    "Enabled": true,
    "IncludeCookies": false,
    "Bucket": "malini-cloudfront-logs-demo.s3.amazonaws.com",
    "Prefix": "cf-logs/"
}

Conclusion:-> CloudFront logging requires ACL-based delivery. Using BucketOwnerPreferred with ACLs enabled and granting CloudFront bucket-owner-full-control resolves AccessDenied errors. This setup works across any region

Best,