Cloudfront distributions are not encrypted
Incident Management が一般に使用できるようになりました。 Incident Management が広範に使用できるようになりました。
<  Back to rules search

Cloudfront distributions are not encrypted

cloudfront

Classification:

compliance

Set up the cloudfront integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Overview

Description

Verify that HTTPS is used to secure AWS CloudFront distributions communications.

Rationale

HTTPS ensures that malicious activity cannot occur when data is sent within AWS CloudFront’s Content Distribution Network (CDN).

Remediation

  1. Run get-distribution-config with your AWS CloudFront distribution ID to retrieve your distribution’s configuration information.

    get-distribution-config.sh

        aws cloudfront get-distribution-config
            --id ID000000000000
        
  2. In a new JSON file, modify the returned configuration. Set OriginProtocolPolicy to https-only and save the configuration file.

    https-only.sh

        {
          "ETag": "ETAG0000000000",
          "DistributionConfig": {
            "Origins": {
              "Items": [
                {
                  "CustomOriginConfig": {
                    "OriginProtocolPolicy": "https-only",
                    ...
                  }
                }
              ]
            }
          }
        }
        
  3. Run update-distribution to update your distribution with your distribution id, the path of the configuration file (created in step 2), and your etag.

    update-distribution.sh

        aws cloudfront update-distribution
            --id ID000000000000
            --distribution-config https-only.json
            --if-match ETAG0000000000