# Ensure CloudFront distributions require HTTPS - Source: https://support.icompaas.com/support/solutions/articles/a_1793292190417442-ensure-cloudfront-distributions-require-https - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that the default cache behavior of every Amazon CloudFront distribution requires viewers to use HTTPS. The viewer protocol policy must be set to **Redirect HTTP to HTTPS** (redirect-to-https) or **HTTPS only** (https-only). The policy **HTTP and HTTPS** (allow-all) lets viewers connect over unencrypted HTTP. **Rationale** Traffic sent over HTTP can be intercepted and modified by anyone on the network path. Attackers can steal cookies, session tokens or personal data, hijack sessions, inject malicious content into responses, or downgrade connections from HTTPS to HTTP. Requiring HTTPS between viewers and CloudFront protects the confidentiality and integrity of this traffic. Encryption should also be extended to the origin, with HTTP Strict Transport Security (HSTS), modern TLS versions and Secure cookies. **Impact** - Encrypts all traffic between viewers and CloudFront - Protects cookies, tokens and personal data from interception and tampering - With **HTTPS only**, clients that use HTTP receive an HTTP 403 error; with **Redirect HTTP to HTTPS**, they are redirected, which adds one round trip for the first request - Clients that cannot use HTTPS, such as old devices or hardcoded HTTP integrations, will stop working until they are updated **Default Value** The viewer protocol policy is chosen for each cache behavior when the distribution is created. CloudFront does not change it automatically. **Pre-Requisites** - IAM permissions: cloudfront:GetDistributionConfig and cloudfront:UpdateDistribution - A valid TLS certificate for any alternate domain names (CNAMEs) of the distribution, issued in AWS Certificate Manager in the **US East (N. Virginia)** region - Confirmation that all clients of the distribution support HTTPS **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console and select **Distributions**. 3. Select a distribution and open the **Behaviors** tab. 4. Check the **Viewer protocol policy** of the \*\*Default (\*)\*\* behavior. 5. Repeat for each distribution. 6. If the policy is **HTTP and HTTPS**, follow the implementation steps. **CLI:** Show the viewer protocol policy of the default cache behavior: aws cloudfront get-distribution-config --id --query "DistributionConfig.DefaultCacheBehavior.ViewerProtocolPolicy" --output text A distribution fails if the value is allow-all. Only the default cache behavior is evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console and select the distribution. 3. Open the **Behaviors** tab, select the \*\*Default (\*) **behavior and choose** Edit\*\*. 4. Set **Viewer protocol policy** to **Redirect HTTP to HTTPS** or **HTTPS only**. 5. Choose **Save changes**. 6. Apply the same setting to the other cache behaviors of the distribution. 7. Repeat for each distribution. **CLI:** Run each command separately: update-distribution accepts only the inner DistributionConfig object together with the current ETag, not the full get-distribution-config output. Save the distribution configuration and get its current ETag: aws cloudfront get-distribution-config --id --query "DistributionConfig" --output json > dist-config.json aws cloudfront get-distribution-config --id --query "ETag" --output text Edit dist-config.json and set DefaultCacheBehavior.ViewerProtocolPolicy to redirect-to-https or https-only, then apply it with the ETag: aws cloudfront update-distribution --id --distribution-config file://dist-config.json --if-match **Backout Plan** Before making changes, save the current distribution configuration: aws cloudfront get-distribution-config --id --query "DistributionConfig" --output json > dist-config-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the CloudFront console, select the distribution and open the **Behaviors** tab. 3. Select the \*\*Default (\*) **behavior and choose** Edit\*\*. 4. Set **Viewer protocol policy** back to **HTTP and HTTPS** and choose **Save changes**. **CLI:** Get the current ETag with the command used in the implementation steps, then restore the saved configuration: aws cloudfront update-distribution --id --distribution-config file://dist-config-backup.json --if-match Note: rolling back allows unencrypted HTTP traffic again. Use it only as a temporary measure while clients are moved to HTTPS. **Reference** - [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html) - [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html) - [https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.