> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTPS Should Be Enabled on CloudFront Distributions

### More Info:

CloudFront distributions should be enabled with HTTPS

### Risk Level

Medium

### Address

Security

### Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, I can help you with that. Here are the steps to remediate the HTTPS misconfiguration on CloudFront Distributions in AWS using the AWS console:

        1. Log in to the AWS Management Console.
        2. Navigate to the CloudFront service.
        3. Click on the ID of the distribution you want to remediate.
        4. Click on the "Behaviors" tab.
        5. Select the behavior that requires HTTPS.
        6. Click on the "Edit" button.
        7. In the "Viewer Protocol Policy" section, select "Redirect HTTP to HTTPS".
        8. Click on the "Yes, Edit" button to save the changes.

        Once the above steps are completed, HTTPS will be enabled on the CloudFront distribution. If you have multiple distributions, you will need to repeat these steps for each of them.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate this misconfiguration for AWS using AWS CLI, you can follow the below steps:

        1. Open the AWS CLI on your local machine or on an EC2 instance.

        2. Run the following command to enable HTTPS on your CloudFront distributions:

        ```
        aws cloudfront update-distribution --id <distribution-id> --default-root-object index.html --viewer-protocol-policy redirect-to-https --no-include-cookies --no-forward-query-string --no-smooth-streaming --no-logging
        ```

        Note: Replace `<distribution-id>` with the ID of your CloudFront distribution.

        3. Wait for the distribution to update. This might take a few minutes.

        4. Run the following command to verify that HTTPS is enabled:

        ```
        aws cloudfront get-distribution --id <distribution-id> --query 'Distribution.DistributionConfig.ViewerCertificate.CloudFrontDefaultCertificate' --output text
        ```

        Note: This command should return "true" to indicate that HTTPS is enabled.

        5. Repeat the above steps for all of your CloudFront distributions.

        By following these steps, you will have successfully enabled HTTPS on your CloudFront distributions.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the HTTPS should be enabled on CloudFront Distributions misconfiguration in AWS using Python, follow these steps:

        1. Import the required modules:

        ```python theme={null}
        import boto3
        ```

        2. Create a boto3 client for CloudFront:

        ```python theme={null}
        client = boto3.client('cloudfront')
        ```

        3. Get a list of all CloudFront distributions:

        ```python theme={null}
        response = client.list_distributions()
        ```

        4. Loop through the distributions and check if HTTPS is enabled:

        ```python theme={null}
        for distribution in response['DistributionList']['Items']:
            if distribution['ViewerCertificate']['CertificateSource'] == 'cloudfront':
                print('HTTPS is already enabled for distribution:', distribution['Id'])
            else:
                print('HTTPS is not enabled for distribution:', distribution['Id'])
        ```

        5. If HTTPS is not enabled, update the distribution to enable HTTPS:

        ```python theme={null}
        client.update_distribution(
            DistributionConfig={
                'Enabled': True,
                'ViewerCertificate': {
                    'CloudFrontDefaultCertificate': True,
                },
            },
            Id=distribution['Id'],
            IfMatch=distribution['ETag']
        )
        ```

        This will enable HTTPS on the CloudFront distribution.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html)