CloudFront distribution uses a custom SSL/TLS certificate

Check ID: cloudfront_distributions_custom_ssl_certificate
Provider: AWS
Service: cloudfront
Severity: MEDIUM
Categories: encryption
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions are configured with a custom SSL/TLS certificate rather than the default *.cloudfront.net certificate for viewer connections.

Risk

Using the default certificate prevents HTTPS on your own hostnames, breaking hostname validation. Clients may face errors or avoid TLS, impacting authentication and availability. Control over TLS posture and domain-bound security headers is reduced, weakening confidentiality and user trust.

Recommendation

Use a custom SSL/TLS certificate covering your domains and configure aliases.
Enforce modern TLS policy, SNI, and HSTS; disable legacy protocols.
Apply least privilege to certificate lifecycle and rotate/monitor keys.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to add Aliases and ViewerCertificate fields, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<example_origin_domain>"
    origin_id   = "origin1"
    s3_origin_config {}
  }

  default_cache_behavior {
    target_origin_id       = "origin1"
    viewer_protocol_policy = "redirect-to-https"
    forwarded_values { query_string = false }
  }

  aliases = ["<example_domain>"]  # CRITICAL: add CNAME covered by the cert

  viewer_certificate {
    acm_certificate_arn = "<example_certificate_arn>"  # CRITICAL: custom ACM cert (in us-east-1)
    ssl_support_method  = "sni-only"                    # CRITICAL: required with ACM cert
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: origin1
            DomainName: <example_origin_domain>
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: origin1
          ViewerProtocolPolicy: redirect-to-https
          ForwardedValues:
            QueryString: false
        Aliases:
          - <example_domain>  # CRITICAL: add an alternate domain name (CNAME) covered by the certificate
        ViewerCertificate:
          AcmCertificateArn: <example_certificate_arn>  # CRITICAL: attach custom ACM cert (must be in us-east-1)
          SslSupportMethod: sni-only  # CRITICAL: required when using ACM cert

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_custom_ssl_certificate. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFormation stack has termination protection enabled CloudFront distribution has a default root object configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires