why need full access of s3 and cloudfront

We set up logging on your behalf, add permissions so that AWS can deliver logfiles, and download and upload files from your S3 buckets. To do those things, we either need a set of credentials for your account, or to have you do most of it for us and grant us the necessary read/write permissions for your logging/reporting buckets.

You can choose which route you'd like to go.

Setting up your own logging and granting us the necessary permissions is relatively straightforward if you know your way around AWS. For most people though, simply giving us a disposable set of credentials works out best.