Back to Checks
aws

CloudFront distribution serves HTTPS requests using SNI

cloudfront_distributions_https_sni_enabled
Service: cloudfrontSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCloudFrontDistribution

CloudFront distributions that use custom SSL/TLS certificates are configured to serve HTTPS using Server Name Indication (ssl_support_method: sni-only). It evaluates SNI use rather than dedicated IP during the TLS handshake.

Prowler logoProwlerprowler-provider-aws

Risk

Without SNI, distributions use dedicated IP SSL, driving higher costs and inefficient IP usage. Dedicated IPs can strain quotas and hinder scaling, reducing availability. Managing IP-bound certificates adds operational risk during rotations and expansions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_https_sni_enabled

Recommendation

Use SNI (sni-only) for HTTPS with custom certificates; avoid dedicated IP unless a critical, non-SNI client requires it. Document and periodically review exceptions, plan client upgrades, and adopt the latest TLS security policy to standardize secure, modern configurations.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change ViewerCertificate.SslSupportMethod to sni-only', then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
    min_ttl = 0
  }

  viewer_certificate {
    acm_certificate_arn      = "<example_certificate_arn>"
    ssl_support_method       = "sni-only"  # Critical: enable SNI for HTTPS
    minimum_protocol_version = "TLSv1"     # Required with SNI
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: <example_origin_id>
            DomainName: <example_origin_domain>
            S3OriginConfig:
              OriginAccessIdentity: ''
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
        ViewerCertificate:
          AcmCertificateArn: <example_certificate_arn>
          SslSupportMethod: sni-only  # Critical: enable SNI for HTTPS
          MinimumProtocolVersion: TLSv1  # Required when using SNI with a custom cert

Other

1In the AWS Console, go to CloudFront and open your distribution
2Select the Settings/General tab and click Edit
3Under SSL certificate, ensure your custom certificate is selected
4Set Client support to SNI only
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)
from prowler.providers.aws.services.cloudfront.cloudfront_service import (
    SSLSupportMethod,
)


class cloudfront_distributions_https_sni_enabled(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            if distribution.certificate:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=distribution
                )

                if distribution.ssl_support_method == SSLSupportMethod.sni_only:
                    report.status = "PASS"
                    report.status_extended = f"CloudFront Distribution {distribution.id} is serving HTTPS requests using SNI."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"CloudFront Distribution {distribution.id} is not serving HTTPS requests using SNI."

                findings.append(report)

        return findings

References