CloudFront + Maintouch
Stream AI agent traffic from your CloudFront distribution with one CloudFormation stack.
Overview
If CloudFront sits in front of your site, every AI agent request passes through it. None of them reach Google Analytics, because agents like GPTBot and ClaudeBot never run your tracking script.
Maintouch gives you a CloudFormation stack that sends your distribution’s access logs to us through Amazon Data Firehose. We keep the hits from known AI agents on your site’s hostname and add them to Agent Analytics, by agent and by page.
How it works
- 01
Save your distribution ID
Paste the ID from the CloudFront console. Maintouch returns a launch link and an access key.
- 02
Launch the stack
Open the link in your AWS account, paste the access key into the masked field and acknowledge the IAM resources.
- 03
Logs start arriving
CloudFront can take a few hours to send the first batch. The connector shows Receiving logs once it lands.
What you get
Five fields, nothing more
The stack asks CloudFront for timestamp, path, user agent, request ID and host only, so you pay to deliver the minimum.
Your hostname only
If the distribution also serves staging or other domains, only requests to your site’s hostname are counted.
Counted once
Each hit is keyed by its CloudFront request ID, so a Firehose retry never counts the same request twice.
Ask Agent M
Ask which pages ClaudeBot crawled this week and get an answer from your CloudFront logs.
Permissions
CloudFront log delivery Sends five access log fields from your distribution to Firehose.Firehose delivery stream Batches the logs and posts them to Maintouch over HTTPS with your access key.IAM role Lets Firehose write failed batches to a backup bucket and log errors to CloudWatch.S3 backup bucket Holds only batches that could not be delivered, and deletes them after 14 days.Questions
Does Maintouch get access to my AWS account?
No. The stack runs in your account and pushes logs out. Maintouch never receives AWS credentials, and the access key only proves a batch came from your stream.
Which CloudFront plans work?
Any plan except Free, which has no access logs. The stack runs in us-east-1, and AWS bills log delivery to Firehose by volume on top of your plan.
What happens when I disconnect?
Maintouch stops counting, but the stack stays in your AWS account. Delete it there too, or Firehose keeps retrying and storing failed batches you pay for.
