Project: KICS (Provisioning / Security & Compliance)
File: a5366a50-932f-4085-896b-41402714a388.md

title: Connection Between CloudFront Origin Not Encrypted hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a5366a50-932f-4085-896b-41402714a388 Query name: Connection Between CloudFront Origin Not Encrypted Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Checks if the connection between the CloudFront and the origin server is encrypted<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="13 30" AWSTemplateFormatVersion: "2010-09-09" Resources: cloudfrontdistribution_1: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp DefaultCacheBehavior: ViewerProtocolPolicy: allow-all LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp IPV6Enabled: true Origins: CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 30 Tags: Key: name Value: example cloudfrontdistribution_2: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: ViewerProtocolPolicy: allow-all LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp DefaultCacheBehavior: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp IPV6Enabled: true Origins: CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 30 Tags: Key: name Value: example ``` ```json title="Positive test num. 2 - json file" hl_lines="56 19" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "cloudfrontdistribution_1": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] } ], "DefaultCacheBehavior": { "ViewerProtocolPolicy": "allow-all", "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] }, "IPV6Enabled": true, "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": 60, "OriginReadTimeout": 30 } } ] }, "Tags": [ { "Key": "name", "Value": "example" } ] } }, "cloudfrontdistribution_2": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Tags": [ { "Key": "name", "Value": "example" } ], "CacheBehaviors": { "ViewerProtocolPolicy": "allow-all", "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] }, "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] }, "IPV6Enabled": true, "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": 60, "OriginReadTimeout": 30 } } ] } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Resources: cloudfrontdistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp DefaultCacheBehavior: LambdaFunctionAssociations: EventType: viewer-request LambdaFunctionARN: examp IPV6Enabled: true Origins: CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 30 Tags: Key: name Value: example ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "cloudfrontdistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] }, "IPV6Enabled": true, "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": 60, "OriginReadTimeout": 30 } } ], "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "viewer-request", "LambdaFunctionARN": "examp" } ] } ] }, "Tags": [ { "Key": "name", "Value": "example" } ] } } } } ```