CloudFront distribution has origin failover configured

Check ID: cloudfront_distributions_multiple_origin_failover_configured
Provider: AWS
Service: cloudfront
Severity: LOW
Categories: resilience
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions are evaluated for an origin group configured with at least 2 origins to support automatic origin failover.

Risk

Without origin failover, the origin becomes a single point of failure. Origin outages, regional incidents, or targeted DoS can cause downtime, elevated error rates, and latency, degrading availability and impacting user experience and SLAs.

Recommendation

Enable origin failover by defining an origin group with primary and secondary origins. Distribute origins across independent zones or providers, set clear failover criteria (e.g., HTTP codes/timeouts), monitor health, and routinely test failover. Align with resilience and defense-in-depth to protect availability.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to add OriginGroups with two origins and FailoverCriteria, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

# Configure an origin group with two origins and use it in the default cache behavior
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<primary_origin_domain>"
    origin_id   = "primary"
    s3_origin_config {}
  }

  origin {
    domain_name = "<secondary_origin_domain>"
    origin_id   = "secondary"
    s3_origin_config {}
  }

  origin_group {
    origin_id = "<example_origin_group_id>"  # Critical: define origin group with 2 origins
    failover_criteria {
      status_codes = [500]  # Critical: fail over on 500 to enable origin failover
    }
    member { origin_id = "primary" }
    member { origin_id = "secondary" }
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_group_id>"  # Critical: use the origin group for requests
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  restrictions {
    geo_restriction { restriction_type = "none" }
  }

  viewer_certificate { cloudfront_default_certificate = true }
}

# CloudFormation: Add an origin group with two origins and use it in the default cache behavior
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          Quantity: 2
          Items:
            - Id: primary
              DomainName: <primary_origin_domain>
              S3OriginConfig: {}
            - Id: secondary
              DomainName: <secondary_origin_domain>
              S3OriginConfig: {}
        OriginGroups:
          Quantity: 1
          Items:
            - Id: <example_origin_group_id>  # Critical: define origin group with 2 origins
              FailoverCriteria:
                StatusCodes:
                  Quantity: 1
                  Items: [500]  # Critical: fail over on 500 to enable origin failover
              Members:
                Quantity: 2
                Items:
                  - OriginId: primary
                  - OriginId: secondary
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_group_id>  # Critical: use the origin group for requests
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_multiple_origin_failover_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution has logging enabled CloudFront distribution encrypts traffic to custom origins

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires