HTTPS Should Be Enabled on CloudFront Distributions

More Info:

CloudFront distributions should be enabled with HTTPS

Risk Level

Medium

Address

Security

Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate this misconfiguration for AWS using AWS CLI, you can follow the below steps:

Open the AWS CLI on your local machine or on an EC2 instance.
Run the following command to enable HTTPS on your CloudFront distributions:

aws cloudfront update-distribution --id <distribution-id> --default-root-object index.html --viewer-protocol-policy redirect-to-https --no-include-cookies --no-forward-query-string --no-smooth-streaming --no-logging

Note: Replace <distribution-id> with the ID of your CloudFront distribution.

Wait for the distribution to update. This might take a few minutes.
Run the following command to verify that HTTPS is enabled:

aws cloudfront get-distribution --id <distribution-id> --query 'Distribution.DistributionConfig.ViewerCertificate.CloudFrontDefaultCertificate' --output text

Note: This command should return “true” to indicate that HTTPS is enabled.

Repeat the above steps for all of your CloudFront distributions.

By following these steps, you will have successfully enabled HTTPS on your CloudFront distributions.

Using Python

To remediate the HTTPS should be enabled on CloudFront Distributions misconfiguration in AWS using Python, follow these steps:

Import the required modules:

import boto3

Create a boto3 client for CloudFront:

client = boto3.client('cloudfront')

Get a list of all CloudFront distributions:

response = client.list_distributions()

Loop through the distributions and check if HTTPS is enabled:

for distribution in response['DistributionList']['Items']:
    if distribution['ViewerCertificate']['CertificateSource'] == 'cloudfront':
        print('HTTPS is already enabled for distribution:', distribution['Id'])
    else:
        print('HTTPS is not enabled for distribution:', distribution['Id'])

If HTTPS is not enabled, update the distribution to enable HTTPS:

client.update_distribution(
    DistributionConfig={
        'Enabled': True,
        'ViewerCertificate': {
            'CloudFrontDefaultCertificate': True,
        },
    },
    Id=distribution['Id'],
    IfMatch=distribution['ETag']
)

This will enable HTTPS on the CloudFront distribution.

Additional Reading:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

HTTPS Should Be Enabled on CloudFront Distributions

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: