Ship S3 and CloudFront access logs to CloudWatch with an AWS Lambda function.