Project: KICS (Provisioning / Security & Compliance)
File: 1419b4c6-6d5c-4534-9cf6-6a5266085333.md

title: CloudFront Without WAF hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1419b4c6-6d5c-4534-9cf6-6a5266085333 Query name: CloudFront Without WAF Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: All AWS CloudFront distributions should be integrated with the Web Application Firewall (AWS WAF) service<br> ```tf title="Positive test num. 1 - tf file" hl_lines="15" module "acm" { source = "terraform-aws-modules/acm/aws" version = "~> v2.0" domainname = var.sitedomain zoneid = data.awsroute53zone.this.zoneid tags = var.tags providers = { aws = aws.useast1 # cloudfront needs acm certificate to be from "us-east-1" region } } resource "awscloudfrontdistribution" "positive1" { origin { domainname = var.publicalb_domain origin_id = "alb" customoriginconfig { http_port = 80 https_port = 443 originprotocolpolicy = "https-only" originsslprotocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } enabled = true isipv6enabled = true comment = var.site_domain aliases = [var.site_domain] defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD", "OPTIONS"] targetoriginid = "alb" forwarded_values { query_string = true headers = ["*"] cookies { forward = "all" } } viewerprotocolpolicy = "redirect-to-https" min_ttl = 0 default_ttl = 0 max_ttl = 0 compress = true } orderedcachebehavior { path_pattern = "wp-content/*" allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD", "OPTIONS"] targetoriginid = "alb" forwarded_values { query_string = true headers = ["Host"] cookies { forward = "all" } } min_ttl = 900 default_ttl = 900 max_ttl = 900 compress = true viewerprotocolpolicy = "redirect-to-https" } orderedcachebehavior { path_pattern = "wp-includes/*" allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD", "OPTIONS"] targetoriginid = "alb" forwarded_values { query_string = true headers = ["Host"] cookies { forward = "all" } } min_ttl = 3600 default_ttl = 3600 max_ttl = 3600 compress = true viewerprotocolpolicy = "redirect-to-https" } priceclass = var.cfprice_class tags = var.tags restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { acmcertificatearn = module.acm.thisacmcertificate_arn sslsupportmethod = "sni-only" minimumprotocolversion = "TLSv1.1_2016" } customerrorresponse { error_code = 400 errorcachingminttl =

} customerrorresponse { error_code = 403 errorcachingminttl = var.errorttl } customerrorresponse { error_code = 404 errorcachingminttl = var.errorttl } customerrorresponse { error_code = 405 errorcachingminttl = var.errorttl } depends_on = [ awsecsservice.this ] } ``` ```tf title="Negative test num. 1 - tf file" module "acm" { source = "terraform-aws-modules/acm/aws" version = "~> v2.0" domainname = var.sitedomain zoneid = data.awsroute53zone.this.zoneid tags = var.tags providers = { aws = aws.useast1 # cloudfront needs acm certificate to be from "us-east-1" region } } resource "awscloudfrontdistribution" "negative1" { origin { domainname = var.publicalb_domain origin_id = "alb" customoriginconfig { http_port = 80 https_port = 443 originprotocolpolicy = "https-only" originsslprotocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } enabled = true isipv6enabled = true comment = var.site_domain webaclid = "test" aliases = [var.site_domain] defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD", "OPTIONS"] targetoriginid = "alb" forwarded_values { query_string = true headers = ["*"] cookies { forward = "all" } } viewerprotocolpolicy = "redirect-to-https" min_ttl = 0 default_ttl = 0 max_ttl = 0 compress = true } orderedcachebehavior { path_pattern = "wp-content/*" allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD", "OPTIONS"] targetoriginid = "alb" forwarded_values { query_string = true headers = ["Host"] cookies { forward = "all" } } min_ttl = 900 default_ttl = 900 max_ttl = 900 compress = true viewerprotocolpolicy = "redirect-to-https" } orderedcachebehavior { path_pattern = "wp-includes/*" allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD", "OPTIONS"] targetoriginid = "alb" forwarded_values { query_string = true headers = ["Host"] cookies { forward = "all" } } min_ttl = 3600 default_ttl = 3600 max_ttl = 3600 compress = true viewerprotocolpolicy = "redirect-to-https" } priceclass = var.cfprice_class tags = var.tags restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { acmcertificatearn = module.acm.thisacmcertificate_arn sslsupportmethod = "sni-only" minimumprotocolversion = "TLSv1.1_2016" } customerrorresponse { error_code = 400 errorcachingminttl = var.errorttl } customerrorresponse { error_code = 403 errorcachingminttl = var.errorttl } customerrorresponse { error_code = 404 errorcachingminttl = var.errorttl } customerrorresponse { error_code = 405 errorcachingminttl = var.errorttl } depends_on = [ awsecsservice.this ] } ```