Description

Ensure that the default cache behavior of every Amazon CloudFront distribution requires viewers to use HTTPS. The viewer protocol policy must be set to Redirect HTTP to HTTPS (redirect-to-https) or HTTPS only (https-only). The policy HTTP and HTTPS (allow-all) lets viewers connect over unencrypted HTTP.

Rationale

Traffic sent over HTTP can be intercepted and modified by anyone on the network path. Attackers can steal cookies, session tokens or personal data, hijack sessions, inject malicious content into responses, or downgrade connections from HTTPS to HTTP. Requiring HTTPS between viewers and CloudFront protects the confidentiality and integrity of this traffic. Encryption should also be extended to the origin, with HTTP Strict Transport Security (HSTS), modern TLS versions and Secure cookies.

Impact

  • Encrypts all traffic between viewers and CloudFront

  • Protects cookies, tokens and personal data from interception and tampering

  • With HTTPS only, clients that use HTTP receive an HTTP 403 error; with Redirect HTTP to HTTPS, they are redirected, which adds one round trip for the first request

  • Clients that cannot use HTTPS, such as old devices or hardcoded HTTP integrations, will stop working until they are updated

Default Value

The viewer protocol policy is chosen for each cache behavior when the distribution is created. CloudFront does not change it automatically.

Pre-Requisites

  • IAM permissions: cloudfront:GetDistributionConfig and cloudfront:UpdateDistribution

  • A valid TLS certificate for any alternate domain names (CNAMEs) of the distribution, issued in AWS Certificate Manager in the US East (N. Virginia) region

  • Confirmation that all clients of the distribution support HTTPS

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console and select Distributions.

  3. Select a distribution and open the Behaviors tab.

  4. Check the Viewer protocol policy of the **Default (*)** behavior.

  5. Repeat for each distribution.

  6. If the policy is HTTP and HTTPS, follow the implementation steps.

CLI:

Show the viewer protocol policy of the default cache behavior:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig.DefaultCacheBehavior.ViewerProtocolPolicy" --output text

A distribution fails if the value is allow-all. Only the default cache behavior is evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console and select the distribution.

  3. Open the Behaviors tab, select the **Default (*) behavior and choose Edit**.

  4. Set Viewer protocol policy to Redirect HTTP to HTTPS or HTTPS only.

  5. Choose Save changes.

  6. Apply the same setting to the other cache behaviors of the distribution.

  7. Repeat for each distribution.

CLI:

Run each command separately: update-distribution accepts only the inner DistributionConfig object together with the current ETag, not the full get-distribution-config output.

Save the distribution configuration and get its current ETag:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig" --output json > dist-config.json
aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text

Edit dist-config.json and set DefaultCacheBehavior.ViewerProtocolPolicy to redirect-to-https or https-only, then apply it with the ETag:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config.json --if-match <ETAG>

Backout Plan

Before making changes, save the current distribution configuration:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "DistributionConfig" --output json > dist-config-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the CloudFront console, select the distribution and open the Behaviors tab.

  3. Select the **Default (*) behavior and choose Edit**.

  4. Set Viewer protocol policy back to HTTP and HTTPS and choose Save changes.

CLI:

Get the current ETag with the command used in the implementation steps, then restore the saved configuration:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config-backup.json --if-match <ETAG>

Note: rolling back allows unencrypted HTTP traffic again. Use it only as a temporary measure while clients are moved to HTTPS.

Reference