CloudFront distribution has a default root object configured

Check ID: cloudfront_distributions_default_root_object
Provider: AWS
Service: cloudfront
Severity: HIGH
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions are evaluated for a configured default root object that maps / requests to a specific file such as index.html, rather than forwarding root requests directly to the origin.

Risk

Without a default root object, root requests can reveal origin listings or unintended files, exposing data (confidentiality) and aiding reconnaissance. They may also return errors, lowering uptime (availability), or route unpredictably, risking wrong content delivery (integrity).

Recommendation

Set a default root object that returns a safe landing page (e.g., index.html). Apply defense in depth: restrict direct origin access, define explicit error pages, and standardize redirects. Test root and subdirectory requests for predictable responses. Align origin permissions with least privilege.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to add DefaultRootObject: “index.html”, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

# Terraform: Set a default root object on a CloudFront distribution
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled             = true
  default_root_object = "index.html" # CRITICAL: ensures a default root object is configured

  origin {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"

    s3_origin_config {}
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
    }
  }
}

# CloudFormation: Set a default root object on a CloudFront distribution
Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        DefaultRootObject: index.html  # CRITICAL: ensures a default root object is configured
        Origins:
          - Id: <example_origin_id>
            DomainName: <example_origin_domain>
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_default_root_object. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution uses a custom SSL/TLS certificate CloudFront distribution has Field Level Encryption enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires