Description

Identifies AWS CloudFront Distributions that are configured to serve content over insecure HTTP protocol. Using HTTP instead of HTTPS exposes the content to man-in-the-middle attacks and data tampering, potentially compromising sensitive information in transit.

Detection Strategy

• Check if resource type is AWS::CloudFront::Distribution in CloudFormation template

• Examine the ViewerProtocolPolicy property in the Distribution configuration

• Report a vulnerability if the policy allows HTTP access (when set to 'allow-all' or HTTP is explicitly enabled)

• Look for these configurations in DistributionConfig > DefaultCacheBehavior and CustomCacheBehavior sections

Vulnerable code example

Resources:
  myDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: 'true'
        DefaultCacheBehavior:
          TargetOriginId: origin1...

✅ Secure code example

Resources:
  myDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: 'true'
        DefaultCacheBehavior:
          TargetOriginId: origin1...