CloudFront distribution serves HTTPS requests using SNI

Check ID: cloudfront_distributions_https_sni_enabled
Provider: AWS
Service: cloudfront
Severity: LOW
Categories: encryption
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions that use custom SSL/TLS certificates are configured to serve HTTPS using Server Name Indication (ssl_support_method: sni-only). It evaluates SNI use rather than dedicated IP during the TLS handshake.

Risk

Without SNI, distributions use dedicated IP SSL, driving higher costs and inefficient IP usage. Dedicated IPs can strain quotas and hinder scaling, reducing availability. Managing IP-bound certificates adds operational risk during rotations and expansions.

Recommendation

Use SNI (sni-only) for HTTPS with custom certificates; avoid dedicated IP unless a critical, non-SNI client requires it. Document and periodically review exceptions, plan client upgrades, and adopt the latest TLS security policy to standardize secure, modern configurations.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to change ViewerCertificate.SslSupportMethod to sni-only’, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
    min_ttl = 0
  }

  viewer_certificate {
    acm_certificate_arn      = "<example_certificate_arn>"
    ssl_support_method       = "sni-only"  # Critical: enable SNI for HTTPS
    minimum_protocol_version = "TLSv1"     # Required with SNI
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: <example_origin_id>
            DomainName: <example_origin_domain>
            S3OriginConfig:
              OriginAccessIdentity: ''
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
        ViewerCertificate:
          AcmCertificateArn: <example_certificate_arn>
          SslSupportMethod: sni-only  # Critical: enable SNI for HTTPS
          MinimumProtocolVersion: TLSv1  # Required when using SNI with a custom cert

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_https_sni_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront viewer protocol policy enforces HTTPS CloudFront distribution has logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires