Back to Checks
aws

CloudFront distribution has Field Level Encryption enabled

cloudfront_distributions_field_level_encryption_enabled
Service: cloudfrontSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCloudFrontDistribution

CloudFront distributions have the default cache behavior associated with Field-Level Encryption via field_level_encryption_id, targeting specified request fields for edge encryption.

Prowler logoProwlerprowler-provider-aws

Risk

Absent field-level encryption, sensitive inputs (PII, payment data, credentials) may surface in origin paths, logs, or middleware in plaintext. This undermines confidentiality, enables data exfiltration and insider misuse, and can lead to session or account compromise if tokens are captured.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_field_level_encryption_enabled

Recommendation

Enable Field-Level Encryption for sensitive request fields and bind it to relevant cache behaviors. Apply least privilege to decryption keys, rotate and monitor keys, and separate duties. As defense in depth, minimize data collection, avoid logging secrets, require HTTPS end-to-end, and validate inputs.

Remediation

CLI

aws cloudfront create-field-level-encryption-config --field-level-encryption-config file://fle-config.json && aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add FieldLevelEncryptionId to DefaultCacheBehavior, then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

# Enable Field Level Encryption on Default Cache Behavior
resource "aws_cloudfront_field_level_encryption_config" "fle" {
  content_type_profile_config {
    forward_when_content_type_is_unknown = true
  }
}

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<example_resource_name>.s3.amazonaws.com"
    origin_id   = "<example_resource_id>"
  }

  default_cache_behavior {
    target_origin_id       = "<example_resource_id>"
    viewer_protocol_policy = "redirect-to-https"
    cache_policy_id        = "658327ea-f89d-4fab-a63d-7e88639e58f6"
    field_level_encryption_id = aws_cloudfront_field_level_encryption_config.fle.id # Critical: enables FLE
  }
}

NativeIaC

# CloudFormation: Enable Field Level Encryption on Default Cache Behavior
Resources:
  FLEConfig:
    Type: AWS::CloudFront::FieldLevelEncryptionConfig
    Properties:
      FieldLevelEncryptionConfig:
        CallerReference: !Ref AWS::StackName
        ContentTypeProfileConfig:
          ForwardWhenContentTypeIsUnknown: true
          ContentTypeProfiles:
            Quantity: 0

  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - DomainName: "<example_resource_name>.s3.amazonaws.com"
            Id: "<example_resource_id>"
            S3OriginConfig: {}
        DefaultCacheBehavior:
          TargetOriginId: "<example_resource_id>"
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
          FieldLevelEncryptionId: !Ref FLEConfig  # Critical: enables FLE on the default cache behavior

Other

1In the AWS Console, go to CloudFront
2If you don't have a Field-level encryption configuration:
3- In the left menu, click Public keys > Add public key (paste your RSA public key)
4- Click Field-level encryption > Create profile (choose the public key and add fields to encrypt)
5- Click Field-level encryption > Create configuration (set the profile as Default profile)
6Attach it to your distribution:
7- Go to Distributions > select <example_resource_id>
8- Choose Behaviors > select Default (*) > Edit
9- Set Field-level encryption configuration to your created configuration
10- Click Save changes and wait for deployment

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)


class cloudfront_distributions_field_level_encryption_enabled(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
            if (
                distribution.default_cache_config
                and distribution.default_cache_config.field_level_encryption_id
            ):
                report.status = "PASS"
                report.status_extended = f"CloudFront Distribution {distribution.id} has Field Level Encryption enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"CloudFront Distribution {distribution.id} has Field Level Encryption disabled."

            findings.append(report)

        return findings

References