Skip to main content

HTTPS Should Be Enabled On CloudFront Distributions

More Info:​

CloudFront distributions should be enabled with HTTPS

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, I can help you with that. Here are the steps to remediate the HTTPS misconfiguration on CloudFront Distributions in AWS using the AWS console:

  1. Log in to the AWS Management Console.
  2. Navigate to the CloudFront service.
  3. Click on the ID of the distribution you want to remediate.
  4. Click on the "Behaviors" tab.
  5. Select the behavior that requires HTTPS.
  6. Click on the "Edit" button.
  7. In the "Viewer Protocol Policy" section, select "Redirect HTTP to HTTPS".
  8. Click on the "Yes, Edit" button to save the changes.

Once the above steps are completed, HTTPS will be enabled on the CloudFront distribution. If you have multiple distributions, you will need to repeat these steps for each of them.

Using CLI

To remediate this misconfiguration for AWS using AWS CLI, you can follow the below steps:

  1. Open the AWS CLI on your local machine or on an EC2 instance.

  2. Run the following command to enable HTTPS on your CloudFront distributions:

aws cloudfront update-distribution --id <distribution-id> --default-root-object index.html --viewer-protocol-policy redirect-to-https --no-include-cookies --no-forward-query-string --no-smooth-streaming --no-logging

Note: Replace <distribution-id> with the ID of your CloudFront distribution.

  1. Wait for the distribution to update. This might take a few minutes.

  2. Run the following command to verify that HTTPS is enabled:

aws cloudfront get-distribution --id <distribution-id> --query 'Distribution.DistributionConfig.ViewerCertificate.CloudFrontDefaultCertificate' --output text

Note: This command should return "true" to indicate that HTTPS is enabled.

  1. Repeat the above steps for all of your CloudFront distributions.

By following these steps, you will have successfully enabled HTTPS on your CloudFront distributions.

Using Python

To remediate the HTTPS should be enabled on CloudFront Distributions misconfiguration in AWS using Python, follow these steps:

  1. Import the required modules:
import boto3
  1. Create a boto3 client for CloudFront:
client = boto3.client('cloudfront')
  1. Get a list of all CloudFront distributions:
response = client.list_distributions()
  1. Loop through the distributions and check if HTTPS is enabled:
for distribution in response['DistributionList']['Items']:
    if distribution['ViewerCertificate']['CertificateSource'] == 'cloudfront':
        print('HTTPS is already enabled for distribution:', distribution['Id'])
    else:
        print('HTTPS is not enabled for distribution:', distribution['Id'])
  1. If HTTPS is not enabled, update the distribution to enable HTTPS:
client.update_distribution(
    DistributionConfig={
        'Enabled': True,
        'ViewerCertificate': {
            'CloudFrontDefaultCertificate': True,
        },
    },
    Id=distribution['Id'],
    IfMatch=distribution['ETag']
)

This will enable HTTPS on the CloudFront distribution.

Using Terraform
resource "aws_cloudfront_distribution" "THIS_DISTRIBUTION" {
  # Replace THIS_DISTRIBUTION with your distribution name/identifier

  enabled             = true
  default_root_object = "index.html"

  origin {
    domain_name = "YOUR_ORIGIN_DOMAIN" # e.g. example.s3.amazonaws.com
    origin_id   = "YOUR_ORIGIN_ID"

    # ...other origin settings...
  }

  default_cache_behavior {
    target_origin_id       = "YOUR_ORIGIN_ID"
    viewer_protocol_policy = "redirect-to-https" # Enforce HTTPS for default behavior

    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    compress         = true
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
    # ...other default cache behavior settings...
  }

  # If you have additional cache behaviors, set the same viewer_protocol_policy there too:
  ordered_cache_behavior {
    path_pattern           = "/SOME_PATH_PATTERN"
    target_origin_id       = "YOUR_ORIGIN_ID"
    viewer_protocol_policy = "redirect-to-https" # Enforce HTTPS for this path

    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    compress         = true
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
    # ...other cache behavior settings...
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
    # or configure your ACM certificate here
  }

  # ...any other required arguments (aliases, logging, etc.)...
}

This change updates viewer_protocol_policy from allow-all (HTTP and HTTPS) to redirect-to-https in default_cache_behavior and every ordered_cache_behavior, matching the CLI remediation’s requirement to enforce HTTPS. The distribution is updated in place (no resource replacement), but CloudFront changes can take several minutes to propagate.

To verify, terraform plan should show viewer_protocol_policy changing from "allow-all" (or "https-only", if that was set) to "redirect-to-https" for the affected cache behaviors, with the resource marked for in-place update (~), not +/-.

Additional Reading:​