All checks
Medium
CloudFront distributions should require encryption in transit
Ensures CloudFront distributions require viewers to use HTTPS for all connections.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Set the viewer protocol policy to HTTPS only or to Redirect HTTP to HTTPS on every cache behavior, the default one and each path pattern: one behavior left on HTTP and HTTPS keeps the finding open. Pick between the two on what your callers do. Redirect answers an http:// request with a 301 and the request still works, while HTTPS only answers 403, so anything hard-coded to the http:// URL breaks.
In the console
CloudFront → Distributions → the distribution → Behaviors → the behavior → Viewer protocol policy
See which of your accounts this check is failing on.
Book a demo