> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloudfront viewer protocol policy remediation ### Triage and Remediation ### Remediation To remediate this misconfiguration in AWS, you can follow the below steps: 1. Log in to your AWS console and navigate to the Amazon CloudFront service. 2. Click on the distribution ID for which you want to enable HTTPS. 3. In the distribution settings, click on the "Behaviors" tab. 4. Select the behavior for which you want to enable HTTPS and click on the "Edit" button. 5. In the "Edit Behavior" window, scroll down to the "Viewer Protocol Policy" section. 6. Select "Redirect HTTP to HTTPS" from the dropdown list. 7. Click on the "Yes, Edit" button to save the changes. 8. Wait for the changes to propagate. This may take a few minutes. 9. Once the changes are propagated, your CloudFront distribution will be configured to use HTTPS for all viewer communications. By following these steps, you can remediate the misconfiguration "Communication With Viewers Should Be Encrypted Using HTTPS" in AWS using the AWS console. # To remediate the misconfiguration "Communication With Viewers Should Be Encrypted Using HTTPS" in AWS using AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine and run the following command to update the CloudFront distribution configuration: ``` aws cloudfront update-distribution --id --distribution-config file:// ``` Note: Replace `` with the ID of your CloudFront distribution and `` with the path to your CloudFront distribution configuration file. 2. In the CloudFront distribution configuration file, add the following JSON code to enable HTTPS encryption for viewer communication: ``` "ViewerCertificate": { "CloudFrontDefaultCertificate": true, "MinimumProtocolVersion": "TLSv1.2_2018", "SSLSupportMethod": "sni-only" } ``` 3. Save the configuration file and run the update-distribution command again to apply the changes. 4. Wait for the CloudFront distribution to deploy the changes. This may take several minutes. 5. Verify that HTTPS encryption is enabled for viewer communication by accessing your CloudFront distribution using HTTPS. You can do this by visiting the domain name of your CloudFront distribution in a web browser and checking that the URL starts with "https\://" and has a green padlock icon. That's it! You have now remediated the misconfiguration "Communication With Viewers Should Be Encrypted Using HTTPS" in AWS using AWS CLI. To remediate the misconfiguration "Communication With Viewers Should Be Encrypted Using HTTPS" for AWS using python, you can follow the below steps: 1. Open the AWS console and navigate to the CloudFront service. 2. Select the distribution for which you want to enable HTTPS. 3. Click on the "Behaviors" tab and select the behavior for which you want to enable HTTPS. 4. Click on "Edit" and then select "Yes" for the "Redirect HTTP to HTTPS" option. 5. Scroll down to the "Viewer Protocol Policy" option and select "Redirect HTTP to HTTPS". 6. Save the changes. To automate this process using Python, you can use the AWS SDK boto3. Here's a sample code: ``` import boto3 # Initialize the CloudFront client cloudfront = boto3.client('cloudfront') # Get the distribution ID for which you want to enable HTTPS distribution_id = 'YOUR_DISTRIBUTION_ID' # Get the current configuration for the distribution response = cloudfront.get_distribution_config(Id=distribution_id) # Enable HTTPS for the viewer response['DistributionConfig']['ViewerCertificate']['MinimumProtocolVersion'] = 'TLSv1.2_2018' # Save the updated configuration cloudfront.update_distribution(DistributionConfig=response['DistributionConfig'], Id=distribution_id, IfMatch=response['ETag']) ``` Note: Replace `YOUR_DISTRIBUTION_ID` with the actual distribution ID for which you want to enable HTTPS. ```hcl theme={null} resource "aws_cloudfront_distribution" "THIS_DISTRIBUTION" { # Replace THIS_DISTRIBUTION with a meaningful name. # Fill in all required arguments (origins, enabled, etc.) for your use case. enabled = true default_root_object = "index.html" origin { domain_name = "ORIGIN_DOMAIN_NAME" # e.g. myapp.s3.amazonaws.com origin_id = "ORIGIN_ID" # add origin configuration as needed } default_cache_behavior { target_origin_id = "ORIGIN_ID" viewer_protocol_policy = "redirect-to-https" # or "https-only" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] compress = true cache_policy_id = "CACHE_POLICY_ID" # replace with your cache policy ID origin_request_policy_id = "ORIGIN_REQUEST_POLICY_ID" # if needed } ordered_cache_behavior { path_pattern = "PATH_PATTERN_1" # e.g. "static/*" target_origin_id = "ORIGIN_ID" viewer_protocol_policy = "redirect-to-https" # or "https-only" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] compress = true cache_policy_id = "CACHE_POLICY_ID_FOR_PATTERN_1" } # Repeat ordered_cache_behavior blocks for every behavior, always # setting viewer_protocol_policy to "redirect-to-https" or "https-only" # so there are no behaviors left with "allow-all". price_class = "PriceClass_100" restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true # or configure your ACM certificate instead } } ``` Updating `viewer_protocol_policy` on an existing distribution changes the distribution in place (no resource replacement), but CloudFront will take time to propagate the new behavior globally. To verify, `terraform plan` should show `viewer_protocol_policy` changing from `"allow-all"` (or any non-HTTPS value) to `"redirect-to-https"` or `"https-only"` in `default_cache_behavior` and in every `ordered_cache_behavior` block.