📝 AWS CloudFront Web Distribution does not encrypt traffic to Custom Origins 🟢

• Contextual name: 📝 Web Distribution does not encrypt traffic to Custom Origins 🟢
• ID: /ce/ca/aws/cloudfront/distribution-traffic-encryption-to-custom-origins
• Located in: 📁 AWS CloudFront

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• AWS Security Hub
  • [[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins]([CloudFront.9] CloudFront distributions should encrypt traffic to custom origins (https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-9)]
• Internal
  • dec-x-3181f359

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-3181f359	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 AWS CloudFront Distribution
  • 🔌 AWS CloudFront Cache Behavior - object.extracts.yaml
  • 🔌 AWS CloudFront Origin - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that AWS CloudFront Distributions communicating with custom origins enforce end‑to‑end encryption by using HTTPS.

Note: Distributions using Amazon S3 buckets as custom origins for static website hosting are excluded, as those endpoints do not support HTTPS.

Rationale

Requiring HTTPS between CloudFront edge locations and your origin ensures that data in transit remains confidential and tamper‑proof, mitigating the risk of man‑in‑the‑middle attacks.

Audit

This policy flags an AWS CloudFront Web Distribution as INCOMPLIANT if at least one custom AWS CloudFront Origin associated with the distribution (excluding S3 static websites as origin) meets one of the following conditions:

• The Origin's Custom Origin Config Protocol Policy field is set to http-only
• The Origin's Custom Origin Config Protocol Policy field is set to match-viewer , and at least one associated AWS CloudFront Cache Behavior has the Viewer Protocol Policy field set to allow-all.

If a Web Distribution has no Origins in the CMDB or a custom Origin's Config Protocol Policy is set to match-viewer but there are no related Cache Behaviors in the CMDB, the Distribution is marked as UNDETERMINED.

Remediation

Open File

Remediation

From Command Line

1. Retrieve the current distribution configuration and capture its ETag:

   aws cloudfront get-distribution-config \
       --id {{distribution-id}} \
       --query 'DistributionConfig' \
       > {{distribution-config}}.json
   
   ETAG=$(aws cloudfront get-distribution-config \
       --id {{distribution-id}} \
       --query 'ETag' \
       --output text)

2. In the downloaded {{distribution-config}}.json, modify the origins (items in the Origins array) and set the OriginProtocolPolicy key in CustomOriginConfig to https-only.

3. Apply the updated configuration to your distribution using the saved ETag:

   aws cloudfront update-distribution \
       --id {{distribution-id}} \
       --if-match $ETAG \
       --distribution-config file://{{distribution-config}}.json 

4. Install an SSL/TLS certificate on your custom origin.

   Important

   If the origin server presents an expired, invalid, or self-signed certificate, supplies the certificate chain in an incorrect order, or omits any intermediate certificates, CloudFront will terminate the TCP connection immediately, return HTTP status code 502 (Bad Gateway) to the viewer, set the X-Cache header to Error from cloudfront.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).		21	22
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudFront.9] CloudFront distributions should encrypt traffic to custom origins		1	1
💼 Cloudaware Framework → 💼 Data Encryption			42
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)		37	64
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	2	36	75
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		25	26
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)	10	8	45
💼 FedRAMP High Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)	1	8	17
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)		8	16
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)		16	24
💼 FedRAMP High Security Controls → 💼 SC-23 Session Authenticity (M)(H)		7	13
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)			64
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)			30
💼 FedRAMP Low Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)	1		17
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			24
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)			64
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	1		60
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)	7		39
💼 FedRAMP Moderate Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)	1		17
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			24
💼 FedRAMP Moderate Security Controls → 💼 SC-23 Session Authenticity (M)(H)			13
💼 ISO/IEC 27001:2013 → 💼 A.10.1.1 Policy on the use of cryptographic controls		18	19
💼 ISO/IEC 27001:2013 → 💼 A.14.1.3 Protecting application services transactions		10	14
💼 NIST CSF v1.1 → 💼 PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation)		10	22
💼 NIST CSF v1.1 → 💼 PR.DS-2: Data-in-transit is protected		16	31
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		47	66
💼 NIST CSF v1.1 → 💼 PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity		22	26
💼 NIST CSF v1.1 → 💼 PR.PT-4: Communications and control networks are protected		10	22
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			134
💼 NIST CSF v2.0 → 💼 PR.AA-06: Physical access to assets is managed, monitored, and enforced commensurate with risk			22
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			114
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			94
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			108
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage			66
💼 NIST SP 800-53 Revision 4 → 💼 CM-3 (6) CRYPTOGRAPHY MANAGEMENT		1	1
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		30	32
💼 SOC 2 → 💼 CC6.7-2 Uses Encryption Technologies or Secure Communication Channels to Protect Data		6	8