Proofsource and Amazon S3: logs you already keep, put to work
If your CloudFront, load balancer or S3 website logs already land in a bucket, Proofsource can read them. Grant a read-only role with one click and every 15 minutes new files are checked for verified AI crawler visits. No keys are stored, and nothing in your account is changed.
Proofsource and Amazon S3 logs, in short
The facts, ready to quote.
- Stage
- Beta, badge shown in the app
- Connects with
- A read-only IAM role created from a one-click CloudFormation template
- Access it needs
- Read of your log bucket only, through a role that trusts Proofsource with your external ID
- Where it shows
- Integrations, Directory, Crawler sources, Amazon S3
- How often
- New log files are read every 15 minutes
- Logs it reads
- CloudFront standard logs, load balancer logs and S3 website access logs
Beta Beta means the S3 source reads real logs today and shows a Beta badge in the app. It is read-only through a role you grant, and the setup lives on the Amazon S3 card in the Directory under Crawler sources.
Why we love Amazon S3 logs
In the makers' own words, from their own pages. Proofsource builds on it, never around it.
Durable, scalable storage
Amazon S3 is built for durability and scale, with versioning, MFA Delete and Object Lock to protect what you keep.
From aws.amazon.comSecurity controls that stay in your hands
S3 gives you Block Public Access, encryption on new uploads, VPC endpoints and IAM Access Analyzer, so you decide exactly who can read a bucket.
From aws.amazon.comStorage classes for every access pattern
S3 offers storage classes tuned to how often you read your data, which makes keeping years of logs practical.
From aws.amazon.comHow Proofsource uses Amazon S3 logs
Reads CloudFront, load balancer or S3 website logs you already keep in S3 every 15 minutes through a read-only role.
- Connect
Grant a read-only role
One click creates an IAM role in your account that trusts Proofsource and carries your brand's external ID.
- Read
Pick up new files
Every 15 minutes Proofsource reads new log files from the bucket and folder you named.
- Show
Count verified visits
Each line joins the same crawler pipeline as every other source, with the IP-range and reverse-DNS check.
- Prove
Tie reads to fixes
Proofsource shows whether crawlers fetched new pages and whether the engines then name you.
Set up Amazon S3 logs in 4 steps
Open Integrations, Directory
Under Crawler sources choose Amazon S3 and select the brand.
Create the role
Use the CloudFormation link on the card for one click, or paste the two policies it shows into IAM by hand.
Enter bucket details
Add the role ARN, the bucket, its region and the log folder, then choose Read now.
Revoke any time
Delete the role in AWS and Proofsource can no longer read anything. No access keys were ever stored.
| Access | What the role allows | Allowed |
|---|---|---|
| Trust | Proofsource's account, with your brand's external ID | Yes |
| Read | List and get objects in the one log bucket | Yes |
| Write or delete | Change or remove anything in your account | No |
| Other buckets | Anything outside the log bucket | No |
What you unlock with Amazon S3 logs
Use logs you already keep
No new pipeline: point at the bucket your logs already fill.
Read-only, no keys
A role with your external ID; no access key is stored.
Verified crawler counts
Real AI visits only, per page.
Every 15 minutes
New files are picked up steadily, without any setup after the first.
Per-page reads
See which pages each engine fetched.
Fix pickup
Check crawlers came back after each fix.
Google AI OverviewsGoogle AI Mode
Questions about Proofsource and Amazon S3 logs
What can Proofsource read in my S3 bucket?
Only the log files in the bucket and folder you name, through a read-only role. It cannot write, delete or list other buckets. It keeps AI crawler visits from each line and discards the rest.
Which logs does this support?
CloudFront standard logs, load balancer logs and S3 website access logs that are already stored in your bucket. If you prefer faster delivery, the CloudFront page describes real-time logs.
Are my AWS keys stored?
No. The role trusts Proofsource's AWS account and requires your brand's external ID, which protects against another party using it. No access key or secret is stored.
What does Beta mean here?
The source works and is read-only, and it shows a Beta badge in the app while we widen the log formats it handles. It is read-only throughout, so there is nothing in your account to undo.
How do I disconnect?
Delete the role in AWS. Proofsource can no longer read the bucket, and the card shows it as disconnected. Past counts stay unless you ask us to remove them.
How does this help my AI visibility?
Logs show which pages AI crawlers actually fetch. Engines cannot cite what they cannot reach, so the counts tell you where to fix first, and Proofsource then checks whether the engines name you.
Which AI engines does Proofsource check?
Up to 10 depending on your plan: ChatGPT, Perplexity, Claude, Google AI Overviews, Google AI Mode, Gemini, Microsoft Copilot, Grok, DeepSeek and Meta AI. The free scan and the trial run four.
Pairs well with Amazon S3 logs
Put Amazon S3 logs to work for your AI visibility.
Scan your brand, connect Amazon S3 logs, and see what AI says about you on up to 10 engines.
Google AI OverviewsGoogle AI Mode