Description

Detects CloudFront distributions configured to allow unencrypted HTTP connections to viewers. This creates a security risk since traffic between CloudFront and end users could be intercepted and read by attackers through man-in-the-middle attacks.

Detection Strategy

• Scans all CloudFront distributions in the AWS account

• Checks the ViewerProtocolPolicy setting in each distribution's DefaultCacheBehavior configuration

• Reports a vulnerability if ViewerProtocolPolicy is set to 'allow-all', which permits insecure HTTP connections

• Recommends configuring ViewerProtocolPolicy to 'https-only' or 'redirect-to-https' to enforce encrypted HTTPS connections