That’s interesting. Thank you for your input.
(For others interested in this thread: enabling access log in CloudFront can be done when creating the distribution. If the distribution is already created, logging can be enabled by editing the distribution options. If one uses a custom origin (say for origin pull distribution), then one will need to provide a valid S3 bucket for the logs to be dumped in.)