# Ensure CloudFront Distributions Are Using SNI to Serve HTTPS Requests

- Source: https://support.icompaas.com/support/solutions/articles/62000233500-ensure-cloudfront-distributions-are-using-sni-to-serve-https-requests
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: 

**Level 2**

#### Description

Server Name Indication (SNI) is an extension to the TLS protocol that allows multiple SSL/TLS certificates to be associated with a single IP address. This enables CloudFront to serve HTTPS requests for multiple domains using a single IP address, improving efficiency and reducing costs.

#### Rationale

-   Cost Efficiency: Reduces the need for dedicated IP addresses, lowering costs.
    
-   Improved Performance: Enhances performance by allowing multiple domains to share a single IP address.
    
-   Enhanced Security: Ensures secure communication between users and CloudFront distributions.
    

#### Impact

Pros:

-   Reduces costs by eliminating the need for dedicated IP addresses.
    
-   Improves performance by allowing multiple domains to share a single IP address.
    
-   Enhances security by ensuring encrypted communication.
    

Cons:

-   May not be supported by very old browsers and clients.
    
-   Requires additional configuration and verification.
    

#### Default Value

By default, CloudFront distributions use SNI to serve HTTPS requests. This must be explicitly verified and configured if necessary.

#### Pre-Requisite

IAM Permissions:

-   cloudfront:GetDistribution
    
-   cloudfront:UpdateDistribution
    
-   AWS CLI installed and configured.
    

#### Remediation

#### Test Plan:

 Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the CloudFront Dashboard.
    
3.  Click on the Distributions tab in the top left navigation menu.
    
4.  Select the Distribution you want to audit.
    
5.  Click on the General tab in the top menu.
    
6.  Check if SNI is enabled for serving HTTPS requests.
    

Using AWS CLI:

Check SNI Status:

aws cloudfront get-distribution --id <distribution-id> --query 'Distribution.DistributionConfig.ViewerCertificate'

#### Implementation Steps: 

Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the CloudFront Dashboard.  
    ![](https://support.icompaas.com/assets/kb/08e36f0158573d1e.png)
    
3.  Click on the Distributions tab in the top left navigation menu.
    
4.  Select the Distribution you want to modify.  
    ![](https://support.icompaas.com/assets/kb/3b0bafd6f1cb6a46.png)
    
5.  Click on the General tab in the top menu.
    
6.  Click Edit to modify the distribution settings.  
    ![](https://support.icompaas.com/assets/kb/1e755fdeed4d0352.png)
    
7.  Ensure that SNI is enabled for serving HTTPS requests.
    
8.  Click Save changes to save the changes.
    

Using AWS CLI:

Enable SNI for serving HTTPS requests:

aws cloudfront update-distribution --id <distribution-id> --distribution-config file://distconfig-sni.json

#### Backout Plan

If enabling SNI causes issues: Using AWS Console:

1.  Navigate to the CloudFront Dashboard.
    
2.  Select the Distribution.
    
3.  Click Edit Attributes.
    
4.  Revert to the previous configuration.
    
5.  Click Save changes to save the changes.
    

Using AWS CLI:

aws cloudfront update-distribution --id <distribution-id> --distribution-config file://distconfig-original.json

  

#### References

-   [AWS CloudFront SNI Documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-https-dedicated-ip-or-sni.html)
    
-   [AWS Config - CloudFront SNI Enabled](https://docs.aws.amazon.com/config/latest/developerguide/cloudfront-sni-enabled.html)
    
-   [Unpacking SNI-based SSL and Dedicated IP SSL for Amazon CloudFront](https://aws.amazon.com/blogs/networking-and-content-delivery/unpacking-sni-based-ssl-and-dedicated-ip-ssl-for-amazon-cloudfront/)
    

#### \=

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.