AWS CloudFront viewer protocol policy is not configured with HTTPS misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_34
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	2cc26fd5-4a45-427e-a3d6-53d77c1790af

Impact

AWS::CloudFront::Distribution ViewerCertificate determines the distribution's SSL/TLS configuration for communicating with viewers. We recommend you use the ViewerProtocolPolicy parameter to enable secure HTTPS communication between clients and your CloudFormation templates. Most browsers and clients released after 2010 support server name indication. AWS recommends to accept HTTPS connections only from viewers that support SNI and advises against receiving HTTPS connections from all viewers, including those that do not support SNI, set SslSupportMethod. This also results in additional monthly charges from CloudFront.

How to Fix

Resource: AWS::CloudFront::Distribution

• Arguments: ViewerProtocolPolicy under Properties.DefaultCacheBehavior or Properties.CacheBehaviors must not be allow-all. Acceptable values are redirect-to-https or https-only. [source,go]

---

Resources: CloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: ... DefaultCacheBehavior: ...

• ViewerProtocolPolicy: 'allow-all'
• ViewerProtocolPolicy: 'https-only' # or 'redirect-to-https'

CacheBehaviors:

• TargetOriginId: customorigin ...
• ViewerProtocolPolicy: allow-all
• ViewerProtocolPolicy: https-only # or redirect-to-https

---