# Ensure CloudFront distributions have Field Level Encryption enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292189728943-ensure-cloudfront-distributions-have-field-level-encryption-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the default cache behavior of every Amazon CloudFront distribution has a field-level encryption configuration associated with it. Field-level encryption lets CloudFront encrypt specific fields of HTTPS POST requests at the edge with a public key, so that only the application holding the matching private key can decrypt them.

**Rationale**

Without field-level encryption, sensitive form fields such as personal data, payment card numbers or credentials pass in plain text through the origin servers, logs and intermediate services once HTTPS is terminated. This increases the risk of data exposure, insider misuse and credential theft. Encrypting sensitive fields at the edge keeps them protected through the application stack, with decryption keys restricted to the components that need them.

**Impact**

-   Keeps selected sensitive fields encrypted from the edge until they reach the component that holds the private key
    
-   Limits the exposure of sensitive data in origin servers, logs and intermediate services
    
-   The application must be changed to decrypt the fields with the private key, so this requires development work and key management
    
-   Field-level encryption only applies to HTTPS POST requests with the configured content types; it has no effect on distributions that only serve static content
    

**Default Value**

CloudFront distributions have no field-level encryption configuration associated with their cache behaviors by default.

**Pre-Requisites**

-   IAM permissions: cloudfront:GetDistributionConfig, cloudfront:UpdateDistribution, cloudfront:CreatePublicKey, cloudfront:CreateFieldLevelEncryptionProfile and cloudfront:CreateFieldLevelEncryptionConfig
    
-   An RSA 2048-bit key pair, with the private key stored securely for the application that will decrypt the fields
    
-   The list of request fields to encrypt, agreed with the application owner
    
-   The default cache behavior must use the viewer protocol policy **Redirect HTTP to HTTPS** or **HTTPS only**, and the origin must be reached over HTTPS
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudFront console and select **Distributions**.
    
3.  Select a distribution and open the **Behaviors** tab.
    
4.  Select the \*\*Default (\*) **behavior, choose** Edit **and check the** Field-level encryption\*\* setting.
    
5.  Repeat for each distribution.
    
6.  If no field-level encryption configuration is selected for the default behavior, follow the implementation steps.
    

**CLI:**

Show the field-level encryption configuration of the default cache behavior:

aws cloudfront get-distribution-config --id <DISTRIBUTION\_ID> --query "DistributionConfig.DefaultCacheBehavior.FieldLevelEncryptionId"

A distribution fails if FieldLevelEncryptionId is empty. Only the default cache behavior is evaluated.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudFront console and select **Public keys** in the left menu. Choose **Create public key**, paste the RSA public key and choose **Create public key**.
    
3.  Select **Field-level encryption** in the left menu and create a profile: select the public key, enter a provider name and the field name patterns to encrypt.
    
4.  In **Field-level encryption**, create a configuration: add a content type profile for application/x-www-form-urlencoded that uses the profile from step 3.
    
5.  Select **Distributions**, select the distribution and open the **Behaviors** tab.
    
6.  Select the \*\*Default (\*) **behavior and choose** Edit\*\*.
    
7.  Set **Field-level encryption** to the configuration from step 4 and choose **Save changes**.
    
8.  Wait until the distribution status is **Deployed**, then update the application to decrypt the fields with the private key.
    
9.  Repeat for each distribution.
    

**CLI:**

Run each command separately: update-distribution accepts only the inner DistributionConfig object together with the current ETag, not the full get-distribution-config output.

Save the following as public-key.json, with your PEM-encoded public key:

{"CallerReference":"<UNIQUE\_REFERENCE>","Name":"<KEY\_NAME>","EncodedKey":"<PEM\_PUBLIC\_KEY>","Comment":"Field-level encryption key"}

Create the public key and note its Id:

aws cloudfront create-public-key --public-key-config file://public-key.json

Save the following as fle-profile.json:

{"Name":"<PROFILE\_NAME>","CallerReference":"<UNIQUE\_REFERENCE>","Comment":"","EncryptionEntities":{"Quantity":1,"Items":\[{"PublicKeyId":"<PUBLIC\_KEY\_ID>","ProviderId":"<PROVIDER\_NAME>","FieldPatterns":{"Quantity":1,"Items":\["<FIELD\_NAME>"\]}}\]}}

Create the field-level encryption profile and note its Id:

aws cloudfront create-field-level-encryption-profile --field-level-encryption-profile-config file://fle-profile.json

Save the following as fle-config.json:

{"CallerReference":"<UNIQUE\_REFERENCE>","Comment":"","ContentTypeProfileConfig":{"ForwardWhenContentTypeIsUnknown":true,"ContentTypeProfiles":{"Quantity":1,"Items":\[{"Format":"URLEncoded","ProfileId":"<PROFILE\_ID>","ContentType":"application/x-www-form-urlencoded"}\]}}}

Create the field-level encryption configuration and note its Id:

aws cloudfront create-field-level-encryption-config --field-level-encryption-config file://fle-config.json

Save the distribution configuration and get its current ETag:

aws cloudfront get-distribution-config --id <DISTRIBUTION\_ID> --query "DistributionConfig" --output json > dist-config.json  
aws cloudfront get-distribution-config --id <DISTRIBUTION\_ID> --query "ETag" --output text

Edit dist-config.json and set DefaultCacheBehavior.FieldLevelEncryptionId to the configuration ID, then apply it with the ETag:

aws cloudfront update-distribution --id <DISTRIBUTION\_ID> --distribution-config file://dist-config.json --if-match <ETAG>

**Backout Plan**

Before making changes, save the current distribution configuration:

aws cloudfront get-distribution-config --id <DISTRIBUTION\_ID> --query "DistributionConfig" --output json > dist-config-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the CloudFront console, select the distribution and open the **Behaviors** tab.
    
3.  Select the \*\*Default (\*) **behavior and choose** Edit\*\*.
    
4.  Clear the **Field-level encryption** setting and choose **Save changes**.
    

**CLI:**

Get the current ETag with the command used in the implementation steps, then restore the saved configuration:

aws cloudfront update-distribution --id <DISTRIBUTION\_ID> --distribution-config file://dist-config-backup.json --if-match <ETAG>

Note: before rolling back, update the application so that it no longer expects encrypted fields. Rolling back exposes the sensitive fields in plain text to the origin again.

**Reference**

-   [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-field-level-encryption-config.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-field-level-encryption-config.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.