Cloudfront traffic to origin unencrypted remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration “CloudFront Distributions Should Use HTTPS For Secure Delivery of Web Content” in AWS using the AWS Console:

Login to the AWS Management Console.
Navigate to the CloudFront console.
Select the distribution(s) that you want to modify.
Click on the “Edit” button at the top of the page.
In the “General” tab, under the “Viewer Protocol Policy” section, select “Redirect HTTP to HTTPS”.
Click on the “Yes, Edit” button to save the changes.
Wait for the changes to propagate.

Once the changes have propagated, your CloudFront distribution(s) will only allow HTTPS connections for secure delivery of web content.

Using CLI

To remediate the misconfiguration “CloudFront Distributions Should Use HTTPS For Secure Delivery of Web Content” for AWS using AWS CLI, follow the below steps:

Login to your AWS account using AWS CLI.
Identify the CloudFront distributions that are not using HTTPS for secure delivery of web content. You can use the following command to list all the CloudFront distributions in your account:
aws cloudfront list-distributions
Once you have identified the CloudFront distribution that is not using HTTPS, you can update it to use HTTPS by using the following command:
aws cloudfront update-distribution --id <distribution_id> --distribution-config file://config.json
Replace <distribution_id> with the ID of the CloudFront distribution that you want to update.

Create a JSON file named config.json and add the following code to it:

{
    "Comment": "Update CloudFront distribution to use HTTPS",
    "Enabled": true,
    "ViewerCertificate": {
        "ACMCertificateArn": "<ACM_certificate_ARN>",
        "MinimumProtocolVersion": "TLSv1.2_2018",
        "SSLSupportMethod": "sni-only"
    },
    "Origins": {
        "Quantity": 1,
        "Items": [
            {
                "Id": "<origin_id>",
                "DomainName": "<origin_domain_name>",
                "OriginPath": "",
                "CustomHeaders": {
                    "Quantity": 0
                },
                "CustomOriginConfig": {
                    "HTTPPort": 80,
                    "HTTPSPort": 443,
                    "OriginProtocolPolicy": "https-only",
                    "OriginSslProtocols": {
                        "Quantity": 3,
                        "Items": [
                            "TLSv1",
                            "TLSv1.1",
                            "TLSv1.2"
                        ]
                    }
                }
            }
        ]
    },
    "DefaultCacheBehavior": {
        "TargetOriginId": "<origin_id>",
        "ViewerProtocolPolicy": "redirect-to-https",
        "MinTTL": 0,
        "AllowedMethods": {
            "Quantity": 7,
            "Items": [
                "HEAD",
                "DELETE",
                "POST",
                "GET",
                "OPTIONS",
                "PUT",
                "PATCH"
            ],
            "CachedMethods": {
                "Quantity": 2,
                "Items": [
                    "GET",
                    "HEAD"
                ]
            }
        },
        "SmoothStreaming": false,
        "Compress": true,
        "LambdaFunctionAssociations": {
            "Quantity": 0
        }
    },
    "PriceClass": "PriceClass_All",
    "Enabled": true
}

Replace <ACM_certificate_ARN> with the ARN of the ACM certificate that you want to use for HTTPS. Replace <origin_id> with the ID of the CloudFront origin that you want to use for HTTPS. Replace <origin_domain_name> with the domain name of the CloudFront origin that you want to use for HTTPS.

Save the config.json file and run the aws cloudfront update-distribution command to update the CloudFront distribution to use HTTPS.
Verify that the CloudFront distribution is now using HTTPS by accessing the distribution’s URL in a web browser. The URL should start with https://.

Using Python

To remediate the misconfiguration of CloudFront distributions not using HTTPS for secure delivery of web content, you can use the following Python script:

First, import the necessary AWS SDK for Python (Boto3) libraries:

import boto3

Next, create a Boto3 client for CloudFront:

cloudfront = boto3.client('cloudfront')

Then, use the list_distributions() method to get a list of all CloudFront distributions:

response = cloudfront.list_distributions()

Loop through the distributions and check if they are using HTTPS:

for distribution in response['DistributionList']['Items']:
    if distribution['ViewerCertificate']['CertificateSource'] != 'cloudfront':
        print("Distribution {} is not using a CloudFront SSL certificate".format(distribution['Id']))
    elif distribution['ViewerCertificate']['MinimumProtocolVersion'] != 'TLSv1.2_2018':
        print("Distribution {} is not using TLSv1.2_2018".format(distribution['Id']))
    elif distribution['ViewerCertificate']['SSLSupportMethod'] != 'sni-only':
        print("Distribution {} is not using SNI-only SSL".format(distribution['Id']))
    else:
        print("Distribution {} is using HTTPS".format(distribution['Id']))

If a distribution is not using HTTPS, update its configuration using the update_distribution() method:

distribution_id = 'YOUR_DISTRIBUTION_ID'

response = cloudfront.get_distribution_config(Id=distribution_id)
config = response['DistributionConfig']

config['ViewerCertificate']['CloudFrontDefaultCertificate'] = True
config['ViewerCertificate']['MinimumProtocolVersion'] = 'TLSv1.2_2018'
config['ViewerCertificate']['SSLSupportMethod'] = 'sni-only'

response = cloudfront.update_distribution(DistributionConfig=config, Id=distribution_id, IfMatch=response['ETag'])

print("Distribution {} has been updated to use HTTPS".format(distribution_id))

Note: Replace YOUR_DISTRIBUTION_ID with the ID of the distribution you want to update.By following these steps, you can remediate the misconfiguration of CloudFront distributions not using HTTPS for secure delivery of web content in AWS using Python.

Using Terraform

resource "aws_cloudfront_distribution" "this" {
  enabled             = true
  comment             = "CLOUDFRONT_DISTRIBUTION_DESCRIPTION"
  default_root_object = "index.html"

  origin {
    domain_name = "CUSTOM_ORIGIN_DOMAIN_NAME" # e.g. app.example.com
    origin_id   = "CUSTOM_ORIGIN_ID"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only" # enforce HTTPS to the origin
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "CUSTOM_ORIGIN_ID"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn            = "ACM_CERTIFICATE_ARN"
    ssl_support_method             = "sni-only"
    minimum_protocol_version       = "TLSv1.2_2021"
  }
}

Replace:

CLOUDFRONT_DISTRIBUTION_DESCRIPTION with a description string.
CUSTOM_ORIGIN_DOMAIN_NAME with your custom origin DNS name.
CUSTOM_ORIGIN_ID with a unique ID for this origin.
ACM_CERTIFICATE_ARN with the ARN of your ACM certificate in us-east-1.

If you have multiple origin blocks using unencrypted traffic, set origin_protocol_policy = "https-only" in each custom_origin_config.terraform plan should show a change to the CloudFront distribution where origin.custom_origin_config.origin_protocol_policy is updated from http-only or match-viewer to https-only, with no resource replacement.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Cloudfront traffic to origin unencrypted remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation