Project: KICS (Provisioning / Security & Compliance)
File: 55af1353-2f62-4fa0-a8e1-a210ca2708f5.md

title: Cloudfront Viewer Protocol Policy Allows HTTP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 55af1353-2f62-4fa0-a8e1-a210ca2708f5 Query name: Cloudfront Viewer Protocol Policy Allows HTTP Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Checks if the connection between CloudFront and the viewer is encrypted<br> ```tf title="Positive test num. 1 - tf file" hl_lines="96 27" resource "awscloudfrontdistribution" "positive1" { origin { domain_name = "mybucket" origin_id = "myS3Origin" s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = "myS3Origin" forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { cloudfrontdefaultcertificate = false minimumprotocolversion = "SSLv3" } } resource "awscloudfrontdistribution" "positive2" { origin { domain_name = "mybucket" origin_id = "myS3Origin" s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = "myS3Origin" forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "https-only" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } orderedcachebehavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] targetoriginid = "myS3Origin" forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewerprotocolpolicy = "allow-all" } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { cloudfrontdefaultcertificate = false minimumprotocolversion = "SSLv3" } } ``` ```tf title="Negative test num. 1 - tf file" resource "awscloudfrontdistribution" "negative1" { origin { domain_name = "mybucket" origin_id = "myS3Origin" s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = "myS3Origin" forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "https-only" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { cloudfrontdefaultcertificate = false minimumprotocolversion = "SSLv3" } } ```