CloudFront distributions should encrypt traffic to custom origins
Flags CloudFront distributions that do not encrypt traffic to custom origins: specifically those with an http-only origin protocol policy, or match-viewer combined with an allow-all viewer protocol policy.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Set each custom origin's protocol to HTTPS only, or to Match viewer on a distribution where every cache behavior already requires HTTPS. Confirm the origin can answer on HTTPS first, under a certificate from a public certificate authority covering its domain name, or viewers get 502s. One origin has no working fix here: an S3 bucket reached through its static website endpoint serves no HTTPS at all, so setting HTTPS only will close this finding and take the origin offline, returning 502 to every viewer. Move that one to the bucket's REST endpoint behind origin access control instead.
In the console
CloudFront → Distributions → the distribution → Origins → the origin → Protocol
See which of your accounts this check is failing on.
Book a demo