> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudfront in use remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate this misconfiguration, you can follow the steps below:

        1. Log in to your AWS console and navigate to the CloudFront service.

        2. Click the "Create Distribution" button.

        3. Choose the type of distribution you want to create. For example, if you want to use CloudFront to deliver your website content, select "Web".

        4. Configure the settings for your distribution. This includes setting the origin, which is the location of your content, and configuring caching settings.

        5. Once you have configured your settings, click "Create Distribution" to create your CloudFront distribution.

        6. After your CloudFront distribution is created, you will need to update your DNS settings to point to your CloudFront distribution. This involves creating a CNAME record in your DNS that points to your CloudFront distribution.

        7. Finally, test your CloudFront distribution to ensure that your content is being delivered correctly.

        By following these steps, you can remediate the misconfiguration and begin using CloudFront to deliver your content.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration in AWS that the account should use CloudFront CDN service, you can follow the below steps using AWS CLI:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to create a new CloudFront distribution:

        ```
        aws cloudfront create-distribution --distribution-config file://distribution-config.json
        ```

        Note: Replace `distribution-config.json` with the path to your CloudFront distribution configuration file.

        3. Update the DNS records for your domain to point to the CloudFront distribution.

        4. Wait for the DNS changes to propagate.

        5. Verify that your website is now being served through CloudFront by visiting your website and checking the response headers for the `X-Cache` header. If the header is present, it means that your website is being served through CloudFront.

        By following these steps, you can remediate the misconfiguration that your AWS account should use CloudFront CDN service.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration in AWS where the account should use CloudFront CDN service, you can use the following steps in Python:

        1. Import the necessary AWS SDK for Python (Boto3) library.

        ```
        import boto3
        ```

        2. Create a CloudFront client object using the `boto3.client()` method.

        ```
        cloudfront = boto3.client('cloudfront')
        ```

        3. Create a new CloudFront distribution using the `create_distribution()` method.

        ```
        response = cloudfront.create_distribution(
            DistributionConfig={
                'CallerReference': 'unique-id', # Specify a unique identifier for the distribution
                'DefaultRootObject': 'index.html', # Specify the default root object
                'Origins': {
                    'Quantity': 1,
                    'Items': [
                        {
                            'Id': 'my-bucket-origin', # Specify a unique identifier for the origin
                            'DomainName': 'my-bucket.s3.amazonaws.com', # Specify the S3 bucket domain name
                            'S3OriginConfig': {
                                'OriginAccessIdentity': '' # Specify the origin access identity
                            }
                        }
                    ]
                },
                'DefaultCacheBehavior': {
                    'TargetOriginId': 'my-bucket-origin', # Specify the origin identifier
                    'ForwardedValues': {
                        'QueryString': False, # Specify whether to forward query strings
                        'Cookies': {
                            'Forward': 'none' # Specify whether to forward cookies
                        }
                    },
                    'ViewerProtocolPolicy': 'redirect-to-https', # Specify the viewer protocol policy
                    'MinTTL': 0 # Specify the minimum TTL
                },
                'Comment': 'My CloudFront distribution', # Specify a comment for the distribution
                'Enabled': True # Specify whether the distribution is enabled
            }
        )
        ```

        4. Wait for the distribution to be deployed using the `wait_until()` method.

        ```
        cloudfront.get_waiter('distribution_deployed').wait(
            Id=response['Distribution']['Id'],
            WaiterConfig={
                'Delay': 30,
                'MaxAttempts': 50
            }
        )
        ```

        5. Update the DNS records to point to the CloudFront distribution using Route 53 or other DNS service.

        ```
        # Example using Route 53
        route53 = boto3.client('route53')

        response = route53.change_resource_record_sets(
            HostedZoneId='Z1234567890123', # Specify the hosted zone ID
            ChangeBatch={
                'Changes': [
                    {
                        'Action': 'UPSERT',
                        'ResourceRecordSet': {
                            'Name': 'example.com', # Specify the domain name
                            'Type': 'A',
                            'AliasTarget': {
                                'HostedZoneId': 'Z2FDTNDATAQYW2', # Specify the CloudFront hosted zone ID
                                'DNSName': 'd1234567890123.cloudfront.net', # Specify the CloudFront DNS name
                                'EvaluateTargetHealth': False
                            }
                        }
                    }
                ]
            }
        )
        ```

        By following these steps, you can remediate the misconfiguration in AWS where the account should use CloudFront CDN service using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_cloudfront_distribution" "PRIMARY_CDN" {
          # Creates a CloudFront CDN distribution so the account is using CloudFront.
          enabled             = true
          comment             = "Primary CloudFront distribution"
          default_root_object = "index.html"

          origins {
            domain_name = aws_s3_bucket.STATIC_SITE_BUCKET.bucket_regional_domain_name
            origin_id   = "s3-origin-STATIC_SITE"

            s3_origin_config {
              origin_access_identity = aws_cloudfront_origin_access_identity.OAI.cloudfront_access_identity_path
            }
          }

          default_cache_behavior {
            target_origin_id       = "s3-origin-STATIC_SITE"
            viewer_protocol_policy = "redirect-to-https"

            allowed_methods = [
              "GET",
              "HEAD",
            ]

            cached_methods = [
              "GET",
              "HEAD",
            ]

            forwarded_values {
              query_string = false

              cookies {
                forward = "none"
              }
            }

            min_ttl                = 0
            default_ttl            = 3600
            max_ttl                = 86400
          }

          restrictions {
            geo_restriction {
              restriction_type = "none"
            }
          }

          viewer_certificate {
            cloudfront_default_certificate = true
          }

          price_class = "PriceClass_100"
        }

        resource "aws_s3_bucket" "STATIC_SITE_BUCKET" {
          bucket = "YOUR_STATIC_SITE_BUCKET_NAME" # replace with the S3 bucket name hosting your static content
        }

        resource "aws_cloudfront_origin_access_identity" "OAI" {
          comment = "Origin Access Identity for STATIC_SITE_BUCKET"
        }

        resource "aws_s3_bucket_policy" "STATIC_SITE_BUCKET_POLICY" {
          bucket = aws_s3_bucket.STATIC_SITE_BUCKET.id

          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              {
                Sid       = "AllowCloudFrontRead"
                Effect    = "Allow"
                Principal = {
                  AWS = aws_cloudfront_origin_access_identity.OAI.iam_arn
                }
                Action   = ["s3:GetObject"]
                Resource = "${aws_s3_bucket.STATIC_SITE_BUCKET.arn}/*"
              }
            ]
          })
        }
        ```

        Substitute:

        * `YOUR_STATIC_SITE_BUCKET_NAME` with the actual S3 bucket name that holds your static site or assets.

        This change creates new resources (an S3 bucket, an origin access identity, and a CloudFront distribution); it does not replace existing distributions but will incur new CloudFront usage.

        To verify, `terraform plan` should show:

        * `+ aws_cloudfront_distribution.PRIMARY_CDN` to be created
        * `+ aws_s3_bucket.STATIC_SITE_BUCKET` to be created (if not already managed)
        * `+ aws_cloudfront_origin_access_identity.OAI` and `+ aws_s3_bucket_policy.STATIC_SITE_BUCKET_POLICY` to be created.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>