CloudFront distribution encrypts traffic to custom origins

Check ID: cloudfront_distributions_origin_traffic_encrypted
Provider: AWS
Service: cloudfront
Severity: MEDIUM
Categories: encryption
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions are evaluated for TLS to origins. The check ensures custom origins use origin_protocol_policy=https-only, or match-viewer only when the viewer protocol policy disallows HTTP. For S3 origins, it inspects the viewer protocol policy and flags allow-all as permitting non-encrypted paths.

Risk

Unencrypted origin links enable on-path interception and manipulation. Secrets, cookies, and PII can be exposed, and responses altered, undermining confidentiality and integrity. This increases chances of session hijacking, cache poisoning, and malicious content injection.

Recommendation

Enforce end-to-end HTTPS. Set origin_protocol_policy to https-only and viewer policy to https-only or redirect-to-https. Use trusted certificates and modern TLS (TLSv1.2+), disabling weak protocols. Apply least privilege and defense in depth by restricting direct origin access and preferring private connectivity.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to change Origins[].CustomOriginConfig.OriginProtocolPolicy to https-only’, then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

# Terraform: set CloudFront origin to use HTTPS only
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"   # FIX: Force CloudFront-to-origin over HTTPS only
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  restrictions { geo_restriction { restriction_type = "none" } }
  viewer_certificate { cloudfront_default_certificate = true }
}

# CloudFormation: set CloudFront origin to use HTTPS only
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: <example_origin_id>
            DomainName: <example_origin_domain>
            CustomOriginConfig:
              OriginProtocolPolicy: https-only  # FIX: Force CloudFront-to-origin over HTTPS only
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_origin_traffic_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront distribution has origin failover configured CloudFront uses Origin Access Control for S3 origins

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires