CloudFront distribution has Field Level Encryption enabled

Check ID: cloudfront_distributions_field_level_encryption_enabled
Provider: AWS
Service: cloudfront
Severity: LOW
Categories: encryption
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions have the default cache behavior associated with Field-Level Encryption via field_level_encryption_id, targeting specified request fields for edge encryption.

Risk

Absent field-level encryption, sensitive inputs (PII, payment data, credentials) may surface in origin paths, logs, or middleware in plaintext. This undermines confidentiality, enables data exfiltration and insider misuse, and can lead to session or account compromise if tokens are captured.

Recommendation

Enable Field-Level Encryption for sensitive request fields and bind it to relevant cache behaviors. Apply least privilege to decryption keys, rotate and monitor keys, and separate duties. As defense in depth, minimize data collection, avoid logging secrets, require HTTPS end-to-end, and validate inputs.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront create-field-level-encryption-config —field-level-encryption-config file://fle-config.json && aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to add FieldLevelEncryptionId to DefaultCacheBehavior, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

# Enable Field Level Encryption on Default Cache Behavior
resource "aws_cloudfront_field_level_encryption_config" "fle" {
  content_type_profile_config {
    forward_when_content_type_is_unknown = true
  }
}

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<example_resource_name>.s3.amazonaws.com"
    origin_id   = "<example_resource_id>"
  }

  default_cache_behavior {
    target_origin_id       = "<example_resource_id>"
    viewer_protocol_policy = "redirect-to-https"
    cache_policy_id        = "658327ea-f89d-4fab-a63d-7e88639e58f6"
    field_level_encryption_id = aws_cloudfront_field_level_encryption_config.fle.id # Critical: enables FLE
  }
}

# CloudFormation: Enable Field Level Encryption on Default Cache Behavior
Resources:
  FLEConfig:
    Type: AWS::CloudFront::FieldLevelEncryptionConfig
    Properties:
      FieldLevelEncryptionConfig:
        CallerReference: !Ref AWS::StackName
        ContentTypeProfileConfig:
          ForwardWhenContentTypeIsUnknown: true
          ContentTypeProfiles:
            Quantity: 0

  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - DomainName: "<example_resource_name>.s3.amazonaws.com"
            Id: "<example_resource_id>"
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: "<example_resource_id>"
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
          FieldLevelEncryptionId: !Ref FLEConfig  # Critical: enables FLE on the default cache behavior

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_field_level_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution has a default root object configured CloudFront distribution has Geo restrictions enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires