CloudFront viewer protocol policy enforces HTTPS

Check ID: cloudfront_distributions_https_enabled
Provider: AWS
Service: cloudfront
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions require viewer connections over HTTPS when the default cache behavior viewer_protocol_policy is https-only or redirect-to-https. Configurations that use allow-all permit HTTP.

Risk

Allowing HTTP exposes traffic to man-in-the-middle interception and session hijacking, enabling theft of cookies, tokens, or PII. Attackers can tamper with responses, inject malware, or perform downgrade/strip attacks, undermining confidentiality and integrity.

Recommendation

Enforce HTTPS-only access for viewers by setting viewer_protocol_policy to https-only or redirect-to-https; avoid allow-all. Extend encryption end-to-end to origins, enable HSTS, prefer modern TLS and ciphers, and mark cookies Secure. This supports defense in depth and prevents downgrade.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to change DefaultCacheBehavior.ViewerProtocolPolicy to “redirect-to-https” or “https-only”, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

# Terraform: set viewer_protocol_policy to force HTTPS
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "redirect-to-https" # Critical: forces HTTP to HTTPS
  }
}

# CloudFormation: set ViewerProtocolPolicy to require HTTPS
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          ViewerProtocolPolicy: https-only  # Critical: requires HTTPS for viewers

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_https_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution has Geo restrictions enabled CloudFront distribution serves HTTPS requests using SNI

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires