Skip to main content

🛡️ AWS CloudFront Web Distribution does not encrypt traffic to Custom Origins🟢

  • Contextual name: 🛡️ Web Distribution does not encrypt traffic to Custom Origins🟢
  • ID: /ce/ca/aws/cloudfront/distribution-traffic-encryption-to-custom-origins
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-3181f3591

Description​

Open File

Description​

Ensure that AWS CloudFront Distributions communicating with custom origins enforce end‑to‑end encryption by using HTTPS.

Note: Distributions using Amazon S3 buckets as custom origins for static website hosting are excluded, as those endpoints do not support HTTPS.

Rationale​

Requiring HTTPS between CloudFront edge locations and your origin ensures that data in transit remains confidential and tamper‑proof, mitigating the risk of man‑in‑the‑middle attacks.

Audit​

This policy flags an AWS CloudFront Web Distribution as INCOMPLIANT if at least one custom AWS CloudFront Origin associated with the distribution (excluding S3 static websites as origin) meets one of the following conditions:

  • The Origin's Custom Origin Config Protocol Policy field is set to http-only
  • The Origin's Custom Origin Config Protocol Policy field is set to match-viewer , and at least one associated AWS CloudFront Cache Behavior has the Viewer Protocol Policy field set to allow-all.

If a Web Distribution has no Origins in the CMDB or a custom Origin's Config Protocol Policy is set to match-viewer but there are no related Cache Behaviors in the CMDB, the Distribution is marked as UNDETERMINED.

Remediation​

Open File

Remediation​

From Command Line​

  1. Retrieve the current distribution configuration and capture its ETag:

    aws cloudfront get-distribution-config \
        --id {{distribution-id}} \
        --query 'DistributionConfig' \
        > {{distribution-config}}.json

    ETAG=$(aws cloudfront get-distribution-config \
        --id {{distribution-id}} \
        --query 'ETag' \
        --output text)

  2. In the downloaded {{distribution-config}}.json, modify the origins (items in the Origins array) and set the OriginProtocolPolicy key in CustomOriginConfig to https-only.

  3. Apply the updated configuration to your distribution using the saved ETag:

    aws cloudfront update-distribution \
        --id {{distribution-id}} \
        --if-match $ETAG \
        --distribution-config file://{{distribution-config}}.json

  4. Install an SSL/TLS certificate on your custom origin.

    Important​

    If the origin server presents an expired, invalid, or self-signed certificate, supplies the certificate chain in an incorrect order, or omits any intermediate certificates, CloudFront will terminate the TCP connection immediately, return HTTP status code 502 (Bad Gateway) to the viewer, set the X-Cache header to Error from cloudfront.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).2122no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudFront.9] CloudFront distributions should encrypt traffic to custom origins11no data
💼 Cloudaware Framework → 💼 Data Encryption57no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)3772no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23789no data
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)2627no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10864no data
💼 FedRAMP High Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)1820no data
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)819no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1634no data
💼 FedRAMP High Security Controls → 💼 SC-23 Session Authenticity (M)(H)716no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)72no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)40no data
💼 FedRAMP Low Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)120no data
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)19no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)34no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)72no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)173no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)753no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)120no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)19no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)34no data
💼 FedRAMP Moderate Security Controls → 💼 SC-23 Session Authenticity (M)(H)16no data
💼 ISO/IEC 27001:2013 → 💼 A.10.1.1 Policy on the use of cryptographic controls1819no data
💼 ISO/IEC 27001:2013 → 💼 A.14.1.3 Protecting application services transactions1015no data
💼 NIST CSF v1.1 → 💼 PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation)1044no data
💼 NIST CSF v1.1 → 💼 PR.DS-2: Data-in-transit is protected1653no data
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented4791no data
💼 NIST CSF v1.1 → 💼 PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity2227no data
💼 NIST CSF v1.1 → 💼 PR.PT-4: Communications and control networks are protected1044no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events149no data
💼 NIST CSF v2.0 → 💼 PR.AA-06: Physical access to assets is managed, monitored, and enforced commensurate with risk44no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected164no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected140no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected156no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage103no data
💼 NIST SP 800-53 Revision 4 → 💼 CM-3 (6) CRYPTOGRAPHY MANAGEMENT11no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains3133no data
💼 SOC 2 → 💼 CC6.7-2 Uses Encryption Technologies or Secure Communication Channels to Protect Data68no data