Back to Checks
aws

CloudFront distribution encrypts traffic to custom origins

cloudfront_distributions_origin_traffic_encrypted
Service: cloudfrontSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCloudFrontDistribution

CloudFront distributions are evaluated for TLS to origins. The check ensures custom origins use origin_protocol_policy=https-only, or match-viewer only when the viewer protocol policy disallows HTTP. For S3 origins, it inspects the viewer protocol policy and flags allow-all as permitting non-encrypted paths.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted origin links enable on-path interception and manipulation. Secrets, cookies, and PII can be exposed, and responses altered, undermining confidentiality and integrity. This increases chances of session hijacking, cache poisoning, and malicious content injection.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_origin_traffic_encrypted

Recommendation

Enforce end-to-end HTTPS. Set origin_protocol_policy to https-only and viewer policy to https-only or redirect-to-https. Use trusted certificates and modern TLS (TLSv1.2+), disabling weak protocols. Apply least privilege and defense in depth by restricting direct origin access and preferring private connectivity.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change Origins[].CustomOriginConfig.OriginProtocolPolicy to https-only', then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

# Terraform: set CloudFront origin to use HTTPS only
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<example_origin_domain>"
    origin_id   = "<example_origin_id>"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"   # FIX: Force CloudFront-to-origin over HTTPS only
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "allow-all"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  restrictions { geo_restriction { restriction_type = "none" } }
  viewer_certificate { cloudfront_default_certificate = true }
}

NativeIaC

# CloudFormation: set CloudFront origin to use HTTPS only
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: <example_origin_id>
            DomainName: <example_origin_domain>
            CustomOriginConfig:
              OriginProtocolPolicy: https-only  # FIX: Force CloudFront-to-origin over HTTPS only
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: allow-all
          ForwardedValues:
            QueryString: false

Other

1In the AWS Console, open CloudFront and select your distribution
2Go to the Origins tab, select the custom origin, and click Edit
3Set Protocol to HTTPS only (Origin protocol policy = HTTPS Only)
4Click Save changes and wait for the distribution to deploy

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)


class cloudfront_distributions_origin_traffic_encrypted(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
            report.status = "PASS"
            report.status_extended = f"CloudFront Distribution {distribution.id} does encrypt traffic to custom origins."
            unencrypted_origins = []

            for origin in distribution.origins:
                if origin.s3_origin_config:
                    # For S3, only check the viewer protocol policy
                    if distribution.viewer_protocol_policy == "allow-all":
                        unencrypted_origins.append(origin.id)
                else:
                    # Regular check for custom origins (ALB, EC2, API Gateway, etc.)
                    if (
                        origin.origin_protocol_policy == ""
                        or origin.origin_protocol_policy == "http-only"
                    ) or (
                        origin.origin_protocol_policy == "match-viewer"
                        and distribution.viewer_protocol_policy == "allow-all"
                    ):
                        unencrypted_origins.append(origin.id)

            if unencrypted_origins:
                report.status = "FAIL"
                report.status_extended = f"CloudFront Distribution {distribution.id} does not encrypt traffic to custom origins {', '.join(unencrypted_origins)}."

            findings.append(report)

        return findings

References