When Access Logs are enabled you can record any request from each user accessing your website and distribution.

These logs are stored to S3 - and that storage is the only thing you will pay for.

CloudFront does not write logs to S3 immediately, but it captures them over a period of time and then saves/delivers them to S3 depending on the amount of requests received (usually between 1 and 24 hours).

If your origin is anything other than S3 you can enable Cookie Logging alongside your Access Logs.