Description

Ensure that every Amazon CloudFront distribution uses a custom SSL/TLS certificate for viewer connections instead of the default *.cloudfront.net certificate. A custom certificate, normally issued by AWS Certificate Manager (ACM), lets viewers connect over HTTPS to your own domain names (alternate domain names or CNAMEs).

Rationale

The default CloudFront certificate only covers the *.cloudfront.net domain, so it cannot provide valid HTTPS for your own hostnames. Clients then receive certificate errors or fall back to unencrypted connections, weakening authentication of the site and the confidentiality of traffic. Using a custom certificate that covers your domains, with SNI and a modern minimum TLS version, gives you control over the TLS configuration and keeps users' trust.

Impact

  • Enables valid HTTPS on your own domain names served through CloudFront

  • Gives control over the certificate and the minimum TLS protocol version

  • Requires an ACM certificate in the US East (N. Virginia) region that covers each alternate domain name, and DNS records that point the domain names to the distribution

  • Changes to the distribution take a few minutes to deploy to all edge locations

Default Value

A new CloudFront distribution without alternate domain names uses the default *.cloudfront.net certificate.

Pre-Requisites

  • IAM permissions: cloudfront:ListDistributions, cloudfront:GetDistributionConfig, cloudfront:UpdateDistribution, acm:ListCertificates and acm:RequestCertificate

  • An issued ACM certificate in the US East (N. Virginia) region (us-east-1) that covers the domain names to be used

  • Access to the DNS zone of the domain names to create the records that point to the distribution

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon CloudFront console and select Distributions.

  3. Select a distribution and, on the General tab, review the Settings section.

  4. Check whether Custom SSL certificate shows a certificate, or whether the default CloudFront certificate is used.

  5. Repeat for each distribution.

  6. If any distribution uses the default CloudFront certificate, follow the implementation steps.

CLI:

Show the certificate settings of all distributions:

aws cloudfront list-distributions --query "DistributionList.Items[].[Id,ViewerCertificate.CloudFrontDefaultCertificate,ViewerCertificate.ACMCertificateArn,ViewerCertificate.IAMCertificateId]" --output table

A distribution fails if CloudFrontDefaultCertificate is True.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon CloudFront console and select Distributions.

  3. Select the distribution and, on the General tab, choose Edit in the Settings section.

  4. Under Alternate domain name (CNAME), add each domain name that will serve the content.

  5. Under Custom SSL certificate, select the ACM certificate that covers these domain names.

  6. Choose Save changes and wait until the distribution finishes deploying.

  7. In your DNS service, create a record for each domain name that points to the distribution's domain name.

  8. Repeat for each affected distribution.

CLI:

Save the current distribution configuration to a file:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query DistributionConfig --output json > dist-config.json

Get the current ETag value of the distribution:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query ETag --output text

Edit dist-config.json and set the Aliases and ViewerCertificate fields as follows, keeping all other fields unchanged:

{"Aliases": {"Quantity": 1, "Items": ["<DOMAIN_NAME>"]}, "ViewerCertificate": {"ACMCertificateArn": "<CERTIFICATE_ARN>", "SSLSupportMethod": "sni-only", "MinimumProtocolVersion": "TLSv1.2_2021"}}

Apply the updated configuration, using the ETag value from the previous step:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config.json --if-match <ETAG>

CloudFront only accepts a complete distribution configuration together with its current ETag, so the change is made in these separate steps.

Backout Plan

Before making changes, save the current distribution configuration:

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query DistributionConfig --output json > dist-config-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon CloudFront console and select the distribution.

  3. On the General tab, choose Edit in the Settings section.

  4. Set Alternate domain name (CNAME) and Custom SSL certificate back to the values in the saved backup.

  5. Choose Save changes.

CLI:

Restore the saved configuration, using the current ETag value of the distribution:

aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://dist-config-backup.json --if-match <ETAG>

Note: rolling back removes HTTPS support for your own domain names on this distribution. Update the DNS records first so that clients are not sent to a hostname the distribution no longer serves.

Reference