Back to Checks
aws

CloudFront distribution has viewer protocol policy set to HTTPS only or redirect to HTTPS

cloudfront_distributions_https_enabled
Service: cloudfrontSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsCloudFrontDistribution

CloudFront distributions require viewer connections over HTTPS when the default cache behavior viewer_protocol_policy is https-only or redirect-to-https. Configurations that use allow-all permit HTTP.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing HTTP exposes traffic to man-in-the-middle interception and session hijacking, enabling theft of cookies, tokens, or PII. Attackers can tamper with responses, inject malware, or perform downgrade/strip attacks, undermining confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_https_enabled

Recommendation

Enforce HTTPS-only access for viewers by setting viewer_protocol_policy to https-only or redirect-to-https; avoid allow-all. Extend encryption end-to-end to origins, enable HSTS, prefer modern TLS and ciphers, and mark cookies Secure. This supports defense in depth and prevents downgrade.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change DefaultCacheBehavior.ViewerProtocolPolicy to "redirect-to-https" or "https-only", then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

# Terraform: set viewer_protocol_policy to force HTTPS
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "redirect-to-https" # Critical: forces HTTP to HTTPS
  }
}

NativeIaC

# CloudFormation: set ViewerProtocolPolicy to require HTTPS
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          ViewerProtocolPolicy: https-only  # Critical: requires HTTPS for viewers

Other

1In the AWS Console, go to CloudFront > Distributions
2Select the target distribution and open the Behaviors tab
3Select the Default (*) behavior and click Edit
4Set Viewer protocol policy to Redirect HTTP to HTTPS (or HTTPS Only)
5Save changes and deploy

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)
from prowler.providers.aws.services.cloudfront.cloudfront_service import (
    ViewerProtocolPolicy,
)


class cloudfront_distributions_https_enabled(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)

            if (
                distribution.default_cache_config
                and distribution.default_cache_config.viewer_protocol_policy
                == ViewerProtocolPolicy.redirect_to_https
            ):
                report.status = "PASS"
                report.status_extended = (
                    f"CloudFront Distribution {distribution.id} has redirect to HTTPS."
                )
            elif (
                distribution.default_cache_config
                and distribution.default_cache_config.viewer_protocol_policy
                == ViewerProtocolPolicy.https_only
            ):
                report.status = "PASS"
                report.status_extended = (
                    f"CloudFront Distribution {distribution.id} has HTTPS only."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"CloudFront Distribution {distribution.id} viewers can use HTTP or HTTPS."

            findings.append(report)

        return findings

References