Stream AWS CloudFront logs to Lume
Forward CloudFront real-time logs to Lume via Amazon Data Firehose HTTP delivery.
Install
1Create a real-time log config
Under CloudFront → Logs, create a real-time config pointing at a Kinesis Data Stream, selecting Lume’s fields in the exact order (Lume parses the delivered line by position).
2Create a Firehose delivery stream
Create an Amazon Data Firehose stream with Source: Kinesis Data Stream and Destination: HTTP Endpoint at https://in.lumetraffic.com/logs/aws; paste your ingest token as the access key.
3Verify
Send traffic through CloudFront: Firehose buffers briefly, then delivers, and events appear on your dashboard.
Good to know
- CloudFront gives viewer country and ASN as selectable fields, no need to read the IP. Optionally append c-ip as the last field to enable crawler verification (used transiently, never stored).
- This is the heaviest of the CDN integrations (Kinesis + Firehose + IAM). If your origin is also behind Cloudflare, the Worker is far simpler.
- Firehose retries non-2xx automatically, and Lume dedupes on the CloudFront request id.
Works with the rest of your stack
Lume is CDN-agnostic and server-side. This is one of several install paths, all feeding the same dashboard. Mix and match across hosts, or move providers without losing your history.
AWS CloudFront FAQ
Why Kinesis and Firehose?
CloudFront real-time logs land in a Kinesis Data Stream; a Firehose delivery stream with an HTTP-endpoint destination forwards them to Lume. It is the heaviest CDN setup: consider the Cloudflare Worker if you’re also on Cloudflare.
Does the field order matter?
Yes. CloudFront delivers a headerless tab-separated line, so Lume parses by position: match the field order in Lume’s docs exactly. Lume validates each line’s shape and rejects mis-ordered configs rather than mis-mapping.
Send your first AWS CloudFront event in minutes.
Free plan, one ingest token. See every human, bot, and AI agent, however you install.
Start for free →