Back to Checks
aws

CloudFront distribution has a default root object configured

cloudfront_distributions_default_root_object
Service: cloudfrontSeverity: high
OfficialBuilt-inVerified
Resource Type:AwsCloudFrontDistribution

CloudFront distributions are evaluated for a configured default root object that maps / requests to a specific file such as index.html, rather than forwarding root requests directly to the origin.

Prowler logoProwlerprowler-provider-aws

Risk

Without a default root object, root requests can reveal origin listings or unintended files, exposing data (confidentiality) and aiding reconnaissance. They may also return errors, lowering uptime (availability), or route unpredictably, risking wrong content delivery (integrity).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_default_root_object

Recommendation

Set a default root object that returns a safe landing page (e.g., index.html). Apply defense in depth: restrict direct origin access, define explicit error pages, and standardize redirects. Test root and subdirectory requests for predictable responses. Align origin permissions with least privilege.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add DefaultRootObject: "index.html", then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

# Terraform: Set a default root object on a CloudFront distribution
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled             = true
  default_root_object = "index.html" # CRITICAL: ensures a default root object is configured

  origin {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"

    s3_origin_config {}
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
    }
  }
}

NativeIaC

# CloudFormation: Set a default root object on a CloudFront distribution
Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        DefaultRootObject: index.html  # CRITICAL: ensures a default root object is configured
        Origins:
          - Id: <example_origin_id>
            DomainName: <example_origin_domain>
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false

Other

1Open the AWS Console and go to CloudFront
2Select the target distribution and choose Settings > General > Edit
3In Default root object, enter index.html (do not start with a /)
4Save changes and wait for deployment to complete

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)


class cloudfront_distributions_default_root_object(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)

            if distribution.default_root_object:
                report.status = "PASS"
                report.status_extended = f"CloudFront Distribution {distribution.id} does have a default root object ({distribution.default_root_object}) configured."
            else:
                report.status = "FAIL"
                report.status_extended = f"CloudFront Distribution {distribution.id} does not have a default root object configured."

            findings.append(report)

        return findings

References