Project: KICS (Provisioning / Security & Compliance)
File: 31733ee2-fef0-4e87-9778-65da22a8ecf1.md

title: Cloudfront Viewer Protocol Policy Allows HTTP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 31733ee2-fef0-4e87-9778-65da22a8ecf1 Query name: Cloudfront Viewer Protocol Policy Allows HTTP Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Checks if the connection between CloudFront and the viewer is encrypted<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="13 30" AWSTemplateFormatVersion: "2010-09-09" Resources: cloudfrontdistribution_1: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp DefaultCacheBehavior: ViewerProtocolPolicy: allow-all LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp IPV6Enabled: true Origins: CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 30 Tags: Key: name Value: example cloudfrontdistribution_2: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: ViewerProtocolPolicy: allow-all LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp DefaultCacheBehavior: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp IPV6Enabled: true Origins: CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 30 Tags: Key: name Value: example ``` ```json title="Positive test num. 2 - json file" hl_lines="10 50" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "cloudfrontdistribution_2": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "CacheBehaviors": [ { "ViewerProtocolPolicy": "allow-all", "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] } ], "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "LambdaFunctionARN": "examp", "EventType": "viewer-request" } ] }, "IPV6Enabled": true, "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": 60, "OriginReadTimeout": 30 } } ], "Tags": [ { "Value": "example", "Key": "name" } ] } } }, "cloudfrontdistribution_1": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "DefaultCacheBehavior": { "ViewerProtocolPolicy": "allow-all", "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] }, "IPV6Enabled": true, "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": 60, "OriginReadTimeout": 30 } } ], "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] } ] }, "Tags": [ { "Key": "name", "Value": "example" } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Resources: cloudfrontdistribution_1: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp DefaultCacheBehavior: ViewerProtocolPolicy: https-only LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp IPV6Enabled: true Origins: CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 30 Tags: Key: name Value: example ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "cloudfrontdistribution_1": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] } ], "DefaultCacheBehavior": { "ViewerProtocolPolicy": "https-only", "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] }, "IPV6Enabled": true, "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": 60, "OriginReadTimeout": 30 } } ] }, "Tags": [ { "Key": "name", "Value": "example" } ] } } } } ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Resources: cloudfrontdistribution_1: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp DefaultCacheBehavior: ViewerProtocolPolicy: redirect-to-https LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp IPV6Enabled: true Origins: CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 30 Tags: Key: name Value: example ```