Back to Checks
aws

CloudFront distribution has origin failover configured with at least two origins

cloudfront_distributions_multiple_origin_failover_configured
Service: cloudfrontSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsCloudFrontDistribution

CloudFront distributions are evaluated for an origin group configured with at least 2 origins to support automatic origin failover.

Prowler logoProwlerprowler-provider-aws

Risk

Without origin failover, the origin becomes a single point of failure. Origin outages, regional incidents, or targeted DoS can cause downtime, elevated error rates, and latency, degrading availability and impacting user experience and SLAs.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_multiple_origin_failover_configured

Recommendation

Enable origin failover by defining an origin group with primary and secondary origins. Distribute origins across independent zones or providers, set clear failover criteria (e.g., HTTP codes/timeouts), monitor health, and routinely test failover. Align with resilience and defense-in-depth to protect availability.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add OriginGroups with two origins and FailoverCriteria, then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

# Configure an origin group with two origins and use it in the default cache behavior
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<primary_origin_domain>"
    origin_id   = "primary"
    s3_origin_config {}
  }

  origin {
    domain_name = "<secondary_origin_domain>"
    origin_id   = "secondary"
    s3_origin_config {}
  }

  origin_group {
    origin_id = "<example_origin_group_id>"  # Critical: define origin group with 2 origins
    failover_criteria {
      status_codes = [500]  # Critical: fail over on 500 to enable origin failover
    }
    member { origin_id = "primary" }
    member { origin_id = "secondary" }
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_group_id>"  # Critical: use the origin group for requests
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  restrictions {
    geo_restriction { restriction_type = "none" }
  }

  viewer_certificate { cloudfront_default_certificate = true }
}

NativeIaC

# CloudFormation: Add an origin group with two origins and use it in the default cache behavior
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          Quantity: 2
          Items:
            - Id: primary
              DomainName: <primary_origin_domain>
              S3OriginConfig: {}
            - Id: secondary
              DomainName: <secondary_origin_domain>
              S3OriginConfig: {}
        OriginGroups:
          Quantity: 1
          Items:
            - Id: <example_origin_group_id>  # Critical: define origin group with 2 origins
              FailoverCriteria:
                StatusCodes:
                  Quantity: 1
                  Items: [500]  # Critical: fail over on 500 to enable origin failover
              Members:
                Quantity: 2
                Items:
                  - OriginId: primary
                  - OriginId: secondary
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_group_id>  # Critical: use the origin group for requests
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none

Other

1In the AWS Console, go to CloudFront and open your distribution
2Select the Origins tab and ensure two origins exist; add a second origin if needed
3In the Origin groups pane, click Create origin group
4Select the two origins; set one as primary and the other as secondary
5Choose at least one failover status code (e.g., 500) and create the group
6Go to Behaviors, edit the relevant cache behavior (or Default behavior)
7Set Origin to the new origin group and save changes
8Deploy/confirm the distribution update

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)


class cloudfront_distributions_multiple_origin_failover_configured(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
            report.status = "FAIL"
            report.status_extended = f"CloudFront Distribution {distribution.id} does not have an origin group configured with at least 2 origins."

            if distribution.origin_failover:
                report.status = "PASS"
                report.status_extended = f"CloudFront Distribution {distribution.id} has an origin group with at least 2 origins configured."

            findings.append(report)

        return findings

References