CloudFront Distributions Should Use HTTPS For Secure Delivery of Web Content
More Info:
The communication between your AWS CloudFront distributions and their custom origins should be encrypted using HTTPS in order to secure the delivery of your web content.Risk Level
MediumAddress
SecurityCompliance Standards
HIPAA, GDPR, AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the misconfiguration “CloudFront Distributions Should Use HTTPS For Secure Delivery of Web Content” in AWS using the AWS Console:
- Login to the AWS Management Console.
- Navigate to the CloudFront console.
- Select the distribution(s) that you want to modify.
- Click on the “Edit” button at the top of the page.
- In the “General” tab, under the “Viewer Protocol Policy” section, select “Redirect HTTP to HTTPS”.
- Click on the “Yes, Edit” button to save the changes.
- Wait for the changes to propagate.
Using CLI
Using CLI
To remediate the misconfiguration “CloudFront Distributions Should Use HTTPS For Secure Delivery of Web Content” for AWS using AWS CLI, follow the below steps:
- Login to your AWS account using AWS CLI.
-
Identify the CloudFront distributions that are not using HTTPS for secure delivery of web content. You can use the following command to list all the CloudFront distributions in your account:
-
Once you have identified the CloudFront distribution that is not using HTTPS, you can update it to use HTTPS by using the following command:
Replace
<distribution_id>with the ID of the CloudFront distribution that you want to update. -
Create a JSON file named
config.jsonand add the following code to it:Replace<ACM_certificate_ARN>with the ARN of the ACM certificate that you want to use for HTTPS. Replace<origin_id>with the ID of the CloudFront origin that you want to use for HTTPS. Replace<origin_domain_name>with the domain name of the CloudFront origin that you want to use for HTTPS. -
Save the
config.jsonfile and run theaws cloudfront update-distributioncommand to update the CloudFront distribution to use HTTPS. -
Verify that the CloudFront distribution is now using HTTPS by accessing the distribution’s URL in a web browser. The URL should start with
https://.
Using Python
Using Python
To remediate the misconfiguration of CloudFront distributions not using HTTPS for secure delivery of web content, you can use the following Python script:Note: Replace
- First, import the necessary AWS SDK for Python (Boto3) libraries:
- Next, create a Boto3 client for CloudFront:
- Then, use the
list_distributions()method to get a list of all CloudFront distributions:
- Loop through the distributions and check if they are using HTTPS:
- If a distribution is not using HTTPS, update its configuration using the
update_distribution()method:
YOUR_DISTRIBUTION_ID with the ID of the distribution you want to update.By following these steps, you can remediate the misconfiguration of CloudFront distributions not using HTTPS for secure delivery of web content in AWS using Python.