mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
chore(aws): enhance metadata for cloudfront service (#8829)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
406aace585
commit
9761651f8d
@@ -33,6 +33,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS Backup service metadata to new format [(#8826)](https://github.com/prowler-cloud/prowler/pull/8826)
|
||||
- Update AWS CloudFormation service metadata to new format [(#8828)](https://github.com/prowler-cloud/prowler/pull/8828)
|
||||
- Update AWS Lambda service metadata to new format [(#8825)](https://github.com/prowler-cloud/prowler/pull/8825)
|
||||
- Update AWS CloudFront service metadata to new format [(#8829)](https://github.com/prowler-cloud/prowler/pull/8829)
|
||||
- Deprecate user authentication for M365 provider [(#8865)](https://github.com/prowler-cloud/prowler/pull/8865)
|
||||
|
||||
### Fixed
|
||||
|
||||
+21
-12
@@ -1,26 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_custom_ssl_certificate",
|
||||
"CheckTitle": "CloudFront distributions should use custom SSL/TLS certificates.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution uses a custom SSL/TLS certificate",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Ensure that your Amazon CloudFront distributions are configured to use a custom SSL/TLS certificate instead of the default one.",
|
||||
"Risk": "Using the default SSL/TLS certificate provided by CloudFront can limit your ability to use custom domain names and may not align with your organization's security policies or branding requirements.",
|
||||
"RelatedUrl": "https://aws.amazon.com/what-is/ssl-certificate/",
|
||||
"Description": "CloudFront distributions are configured with a **custom SSL/TLS certificate** rather than the default `*.cloudfront.net` certificate for viewer connections.",
|
||||
"Risk": "Using the default certificate prevents HTTPS on your own hostnames, breaking hostname validation. Clients may face errors or avoid TLS, impacting **authentication** and **availability**. Control over TLS posture and domain-bound security headers is reduced, weakening **confidentiality** and user trust.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-distro-custom-tls.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-7",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000233491-ensure-cloudfront-distributions-use-custom-ssl-tls-certificates",
|
||||
"https://reintech.io/blog/configure-https-ssl-certificates-cloudfront-distributions"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/ensure-aws-cloudfront-distribution-uses-custom-ssl-certificate/",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-7",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-distro-custom-tls.html"
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add Aliases and ViewerCertificate fields, then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - Id: origin1\n DomainName: <example_origin_domain>\n S3OriginConfig: {}\n DefaultCacheBehavior:\n TargetOriginId: origin1\n ViewerProtocolPolicy: redirect-to-https\n ForwardedValues:\n QueryString: false\n Aliases:\n - <example_domain> # CRITICAL: add an alternate domain name (CNAME) covered by the certificate\n ViewerCertificate:\n AcmCertificateArn: <example_certificate_arn> # CRITICAL: attach custom ACM cert (must be in us-east-1)\n SslSupportMethod: sni-only # CRITICAL: required when using ACM cert\n```",
|
||||
"Other": "1. Open the CloudFront console and select your distribution\n2. Go to the Settings/General tab and click Edit\n3. In Alternate domain name (CNAME), add <example_domain>\n4. In SSL certificate, choose Custom SSL certificate and select your ACM certificate (issued in us-east-1 and covering <example_domain>)\n5. Click Save/Yes, Edit and wait for the distribution to deploy",
|
||||
"Terraform": "```hcl\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n\n origin {\n domain_name = \"<example_origin_domain>\"\n origin_id = \"origin1\"\n s3_origin_config {}\n }\n\n default_cache_behavior {\n target_origin_id = \"origin1\"\n viewer_protocol_policy = \"redirect-to-https\"\n forwarded_values { query_string = false }\n }\n\n aliases = [\"<example_domain>\"] # CRITICAL: add CNAME covered by the cert\n\n viewer_certificate {\n acm_certificate_arn = \"<example_certificate_arn>\" # CRITICAL: custom ACM cert (in us-east-1)\n ssl_support_method = \"sni-only\" # CRITICAL: required with ACM cert\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure your CloudFront distributions to use a custom SSL/TLS certificate to enable secure access via your own domain names and meet specific security and branding needs. This allows for more control over encryption and authentication settings.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#CreatingCNAME"
|
||||
"Text": "- Use a **custom SSL/TLS certificate** covering your domains and configure aliases.\n- Enforce modern TLS policy, **SNI**, and **HSTS**; disable legacy protocols.\n- Apply **least privilege** to certificate lifecycle and rotate/monitor keys.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_custom_ssl_certificate"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+19
-12
@@ -1,26 +1,33 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_default_root_object",
|
||||
"CheckTitle": "Check if CloudFront distributions have a default root object.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution has a default root object configured",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions have a default root object.",
|
||||
"Risk": "Without a default root object, requests to the root URL may result in an error or expose unintended content, leading to potential security risks and a poor user experience.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.html#DefaultRootObjectHow",
|
||||
"Description": "CloudFront distributions are evaluated for a configured **default root object** that maps `/` requests to a specific file such as `index.html`, rather than forwarding root requests directly to the origin.",
|
||||
"Risk": "Without a **default root object**, root requests can reveal **origin listings** or unintended files, exposing data (**confidentiality**) and aiding reconnaissance. They may also return errors, lowering uptime (**availability**), or route unpredictably, risking wrong content delivery (**integrity**).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-1",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-default-object.html",
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws cloudfront update-distribution --id <distribution-id> --default-root-object <new-root-object>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-1",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-default-object.html"
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add DefaultRootObject: \"index.html\", then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Set a default root object on a CloudFront distribution\nResources:\n CloudFrontDistribution:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n DefaultRootObject: index.html # CRITICAL: ensures a default root object is configured\n Origins:\n - Id: <example_origin_id>\n DomainName: <example_origin_domain>\n S3OriginConfig: {}\n DefaultCacheBehavior:\n TargetOriginId: <example_origin_id>\n ViewerProtocolPolicy: allow-all\n ForwardedValues:\n QueryString: false\n```",
|
||||
"Other": "1. Open the AWS Console and go to CloudFront\n2. Select the target distribution and choose Settings > General > Edit\n3. In Default root object, enter index.html (do not start with a /)\n4. Save changes and wait for deployment to complete",
|
||||
"Terraform": "```hcl\n# Terraform: Set a default root object on a CloudFront distribution\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n default_root_object = \"index.html\" # CRITICAL: ensures a default root object is configured\n\n origin {\n domain_name = \"<example_origin_domain>\"\n origin_id = \"<example_origin_id>\"\n\n s3_origin_config {}\n }\n\n default_cache_behavior {\n target_origin_id = \"<example_origin_id>\"\n viewer_protocol_policy = \"allow-all\"\n forwarded_values {\n query_string = false\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure a default root object for your CloudFront distribution to ensure that a specific file (such as index.html) is returned when users access the root URL. This improves user experience and ensures that sensitive content isn't accidentally exposed.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.html#DefaultRootObjectHowToDefine"
|
||||
"Text": "Set a **default root object** that returns a safe landing page (e.g., `index.html`). Apply **defense in depth**: restrict direct origin access, define explicit error pages, and standardize redirects. Test root and subdirectory requests for predictable responses. Align origin permissions with **least privilege**.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_default_root_object"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
|
||||
+19
-12
@@ -1,26 +1,33 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_field_level_encryption_enabled",
|
||||
"CheckTitle": "Check if CloudFront distributions have Field Level Encryption enabled.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution has Field Level Encryption enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions have Field Level Encryption enabled.",
|
||||
"Risk": "Allows you protect specific data throughout system processing so that only certain applications can see it.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html",
|
||||
"Description": "CloudFront distributions have the default cache behavior associated with **Field-Level Encryption** via `field_level_encryption_id`, targeting specified request fields for edge encryption.",
|
||||
"Risk": "Absent **field-level encryption**, sensitive inputs (PII, payment data, credentials) may surface in origin paths, logs, or middleware in plaintext. This undermines **confidentiality**, enables data exfiltration and insider misuse, and can lead to session or account compromise if tokens are captured.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/field-level-encryption-enabled.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/field-level-encryption-enabled.html",
|
||||
"Terraform": ""
|
||||
"CLI": "aws cloudfront create-field-level-encryption-config --field-level-encryption-config file://fle-config.json && aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add FieldLevelEncryptionId to DefaultCacheBehavior, then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Enable Field Level Encryption on Default Cache Behavior\nResources:\n FLEConfig:\n Type: AWS::CloudFront::FieldLevelEncryptionConfig\n Properties:\n FieldLevelEncryptionConfig:\n CallerReference: !Ref AWS::StackName\n ContentTypeProfileConfig:\n ForwardWhenContentTypeIsUnknown: true\n ContentTypeProfiles:\n Quantity: 0\n\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - DomainName: \"<example_resource_name>.s3.amazonaws.com\"\n Id: \"<example_resource_id>\"\n S3OriginConfig: {}\n DefaultCacheBehavior:\n TargetOriginId: \"<example_resource_id>\"\n ViewerProtocolPolicy: redirect-to-https\n CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6\n FieldLevelEncryptionId: !Ref FLEConfig # Critical: enables FLE on the default cache behavior\n```",
|
||||
"Other": "1. In the AWS Console, go to CloudFront\n2. If you don't have a Field-level encryption configuration:\n - In the left menu, click Public keys > Add public key (paste your RSA public key)\n - Click Field-level encryption > Create profile (choose the public key and add fields to encrypt)\n - Click Field-level encryption > Create configuration (set the profile as Default profile)\n3. Attach it to your distribution:\n - Go to Distributions > select <example_resource_id>\n - Choose Behaviors > select Default (*) > Edit\n - Set Field-level encryption configuration to your created configuration\n - Click Save changes and wait for deployment",
|
||||
"Terraform": "```hcl\n# Enable Field Level Encryption on Default Cache Behavior\nresource \"aws_cloudfront_field_level_encryption_config\" \"fle\" {\n content_type_profile_config {\n forward_when_content_type_is_unknown = true\n }\n}\n\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n\n origin {\n domain_name = \"<example_resource_name>.s3.amazonaws.com\"\n origin_id = \"<example_resource_id>\"\n }\n\n default_cache_behavior {\n target_origin_id = \"<example_resource_id>\"\n viewer_protocol_policy = \"redirect-to-https\"\n cache_policy_id = \"658327ea-f89d-4fab-a63d-7e88639e58f6\"\n field_level_encryption_id = aws_cloudfront_field_level_encryption_config.fle.id # Critical: enables FLE\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Check if applicable to any sensitive data. This encryption ensures that only applications that need the data—and have the credentials to decrypt it - are able to do so.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html"
|
||||
"Text": "Enable **Field-Level Encryption** for sensitive request fields and bind it to relevant cache behaviors. Apply **least privilege** to decryption keys, rotate and monitor keys, and separate duties. As **defense in depth**, minimize data collection, avoid logging secrets, require HTTPS end-to-end, and validate inputs.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_field_level_encryption_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+22
-13
@@ -1,29 +1,38 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_geo_restrictions_enabled",
|
||||
"CheckTitle": "Check if Geo restrictions are enabled in CloudFront distributions.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution has Geo restrictions enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if Geo restrictions are enabled in CloudFront distributions.",
|
||||
"Risk": "Consider countries where service should not be accessed, by legal or compliance requirements. Additionally if not restricted the attack vector is increased.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html",
|
||||
"Description": "**CloudFront distributions** have **geographic restrictions** configured to limit access by country using an allowlist or blocklist (`RestrictionType` not `none`).",
|
||||
"Risk": "Absent geo restrictions, content is globally reachable, enabling:\n- Access from sanctioned or unlicensed regions (confidentiality/compliance)\n- Broader bot abuse, scraping, and DDoS staging (availability)\n- More credential-stuffing and fraud attempts against apps",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://repost.aws/knowledge-center/cloudfront-geo-restriction",
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/geo-restriction.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/geo-restriction.html",
|
||||
"Terraform": ""
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add Restrictions.GeoRestriction with RestrictionType: \"whitelist\" and Locations: [\"US\"], then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - DomainName: \"<example_origin_domain>\"\n Id: \"<example_origin_id>\"\n DefaultCacheBehavior:\n TargetOriginId: \"<example_origin_id>\"\n ViewerProtocolPolicy: allow-all\n CachePolicyId: \"<example_cache_policy_id>\"\n Restrictions:\n GeoRestriction:\n RestrictionType: whitelist # CRITICAL: enables geo restrictions\n Locations: # CRITICAL: at least one allowed country\n - US\n```",
|
||||
"Other": "1. In the AWS Console, go to CloudFront > Distributions\n2. Select the target distribution\n3. Open the Security tab > Geographic restrictions > Edit\n4. Choose Allow list (or Block list)\n5. Add at least one country to the list\n6. Save changes",
|
||||
"Terraform": "```hcl\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n\n origins {\n domain_name = \"<example_origin_domain>\"\n origin_id = \"<example_origin_id>\"\n }\n\n default_cache_behavior {\n target_origin_id = \"<example_origin_id>\"\n viewer_protocol_policy = \"allow-all\"\n cache_policy_id = \"<example_cache_policy_id>\"\n }\n\n restrictions {\n geo_restriction {\n restriction_type = \"whitelist\" # CRITICAL: enables geo restrictions\n locations = [\"US\"] # CRITICAL: at least one allowed country\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "If possible, define and enable Geo restrictions for this service.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html"
|
||||
"Text": "Apply **least privilege** to distribution scope: enable geo restrictions with a country **allowlist** where feasible, or maintain a precise blocklist aligned to legal, licensing, and threat models.\n\nLayer **defense in depth**: use WAF/bot controls, signed URLs or cookies, and monitoring to detect abuse and configuration drift.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_geo_restrictions_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": "Infrastructure Security"
|
||||
|
||||
+21
-12
@@ -1,26 +1,35 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_https_enabled",
|
||||
"CheckTitle": "Check if CloudFront distributions are set to HTTPS.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution has viewer protocol policy set to HTTPS only or redirect to HTTPS",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions are set to HTTPS.",
|
||||
"Risk": "If not enabled sensitive information in transit is not protected. Surveillance and other threats are risks may exists.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
|
||||
"Description": "CloudFront distributions require viewer connections over **HTTPS** when the default cache behavior `viewer_protocol_policy` is `https-only` or `redirect-to-https`. Configurations that use `allow-all` permit HTTP.",
|
||||
"Risk": "Allowing HTTP exposes traffic to **man-in-the-middle** interception and **session hijacking**, enabling theft of cookies, tokens, or PII. Attackers can **tamper** with responses, inject malware, or perform **downgrade/strip** attacks, undermining confidentiality and integrity.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/security-policy.html",
|
||||
"https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html",
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/networking-policies/networking_32#cloudformation",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/security-policy.html",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/networking-policies/networking_32#terraform"
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change DefaultCacheBehavior.ViewerProtocolPolicy to \"redirect-to-https\" or \"https-only\", then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: set ViewerProtocolPolicy to require HTTPS\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n DefaultCacheBehavior:\n ViewerProtocolPolicy: https-only # Critical: requires HTTPS for viewers\n```",
|
||||
"Other": "1. In the AWS Console, go to CloudFront > Distributions\n2. Select the target distribution and open the Behaviors tab\n3. Select the Default (*) behavior and click Edit\n4. Set Viewer protocol policy to Redirect HTTP to HTTPS (or HTTPS Only)\n5. Save changes and deploy",
|
||||
"Terraform": "```hcl\n# Terraform: set viewer_protocol_policy to force HTTPS\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n default_cache_behavior {\n target_origin_id = \"<example_origin_id>\"\n viewer_protocol_policy = \"redirect-to-https\" # Critical: forces HTTP to HTTPS\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use HTTPS everywhere possible. It will enforce privacy and protect against account hijacking and other threats.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html"
|
||||
"Text": "Enforce **HTTPS-only** access for viewers by setting `viewer_protocol_policy` to `https-only` or `redirect-to-https`; avoid `allow-all`. Extend encryption end-to-end to origins, enable **HSTS**, prefer modern TLS and ciphers, and mark cookies `Secure`. This supports **defense in depth** and prevents downgrade.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_https_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+20
-12
@@ -1,26 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_https_sni_enabled",
|
||||
"CheckTitle": "Check if CloudFront distributions are using SNI to serve HTTPS requests.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution serves HTTPS requests using SNI",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions are using SNI to serve HTTPS requests.",
|
||||
"Risk": "If SNI is not used, CloudFront will allocate a dedicated IP address for each SSL certificate, leading to higher costs and inefficient IP address utilization. This could also complicate scaling and managing multiple distributions, especially if your domain requires multiple SSL certificates.",
|
||||
"RelatedUrl": "https://www.cloudflare.com/es-es/learning/ssl/what-is-sni/",
|
||||
"Description": "**CloudFront distributions** that use **custom SSL/TLS certificates** are configured to serve **HTTPS** using **Server Name Indication** (`ssl_support_method: sni-only`). It evaluates SNI use rather than dedicated IP during the TLS handshake.",
|
||||
"Risk": "Without **SNI**, distributions use dedicated IP SSL, driving higher costs and inefficient IP usage. Dedicated IPs can strain quotas and hinder scaling, reducing **availability**. Managing IP-bound certificates adds **operational risk** during rotations and expansions.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-sni.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-8",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000223557-ensure-cloudfront-sni-enabled",
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-https-dedicated-ip-or-sni.html#cnames-https-sni"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-8",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-sni.html"
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change ViewerCertificate.SslSupportMethod to sni-only', then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - Id: <example_origin_id>\n DomainName: <example_origin_domain>\n S3OriginConfig:\n OriginAccessIdentity: ''\n DefaultCacheBehavior:\n TargetOriginId: <example_origin_id>\n ViewerProtocolPolicy: allow-all\n ForwardedValues:\n QueryString: false\n Cookies:\n Forward: none\n MinTTL: 0\n ViewerCertificate:\n AcmCertificateArn: <example_certificate_arn>\n SslSupportMethod: sni-only # Critical: enable SNI for HTTPS\n MinimumProtocolVersion: TLSv1 # Required when using SNI with a custom cert\n```",
|
||||
"Other": "1. In the AWS Console, go to CloudFront and open your distribution\n2. Select the Settings/General tab and click Edit\n3. Under SSL certificate, ensure your custom certificate is selected\n4. Set Client support to SNI only\n5. Click Save changes",
|
||||
"Terraform": "```hcl\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n\n origin {\n domain_name = \"<example_origin_domain>\"\n origin_id = \"<example_origin_id>\"\n }\n\n default_cache_behavior {\n target_origin_id = \"<example_origin_id>\"\n viewer_protocol_policy = \"allow-all\"\n forwarded_values {\n query_string = false\n cookies { forward = \"none\" }\n }\n min_ttl = 0\n }\n\n viewer_certificate {\n acm_certificate_arn = \"<example_certificate_arn>\"\n ssl_support_method = \"sni-only\" # Critical: enable SNI for HTTPS\n minimum_protocol_version = \"TLSv1\" # Required with SNI\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure that your CloudFront distributions are configured to use Server Name Indication (SNI) when serving HTTPS requests with custom SSL/TLS certificates. This is the recommended approach for reducing costs and optimizing IP address usage.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-https-dedicated-ip-or-sni.html#cnames-https-sni"
|
||||
"Text": "Use **SNI** (`sni-only`) for **HTTPS** with custom certificates; avoid dedicated IP unless a critical, non-SNI client requires it. Document and periodically review exceptions, plan client upgrades, and adopt the latest **TLS security policy** to standardize secure, modern configurations.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_https_sni_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+22
-13
@@ -1,30 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_logging_enabled",
|
||||
"CheckTitle": "Check if CloudFront distributions have logging enabled.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution has logging enabled",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions have logging enabled.",
|
||||
"Risk": "If not enabled monitoring of service use is not possible.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html",
|
||||
"Description": "**CloudFront distributions** record viewer requests using either **standard access logs** or an attached **real-time log configuration**.\n\nThe finding evaluates whether logging is configured so request metadata is captured for each distribution.",
|
||||
"Risk": "Missing **CloudFront logs** blinds monitoring of edge requests, impeding detection of bot abuse, credential stuffing, origin probing, and cache-bypass attempts.\n\nThis delays incident response and weakens evidence for forensics, impacting **confidentiality**, **integrity**, and **availability**.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html",
|
||||
"https://repost.aws/knowledge-center/cloudfront-logging-requests",
|
||||
"https://aws.amazon.com/awstv/watch/e895e7811ac/",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/enable-real-time-logging.html",
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config logging.json --if-match <ETAG>",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/logging-policies/logging_20#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/logging-policies/logging_20",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/logging-policies/logging_20#terraform"
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add Logging.Bucket: <example_bucket>.s3.amazonaws.com', then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: enable CloudFront standard access logging\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - Id: origin1\n DomainName: <example_origin_domain>\n S3OriginConfig: {}\n DefaultCacheBehavior:\n TargetOriginId: origin1\n ViewerProtocolPolicy: allow-all\n Logging:\n Bucket: <example_bucket>.s3.amazonaws.com # CRITICAL: enables standard access logs to S3 for this distribution\n # The presence of Logging with Bucket turns on access logging\n```",
|
||||
"Other": "1. In the AWS Console, go to CloudFront and select your distribution\n2. Open the General tab and click Edit\n3. In Standard logging, set to On\n4. Select the S3 bucket to receive logs\n5. Ensure the S3 bucket has Object Ownership set to ACLs enabled (Bucket owner preferred/ObjectWriter)\n6. Save changes",
|
||||
"Terraform": "```hcl\n# Add this block to your existing CloudFront distribution to enable access logging\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n # ... existing required config ...\n logging_config {\n bucket = \"<example_bucket>.s3.amazonaws.com\" # CRITICAL: enables standard access logs to S3\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Real-time monitoring can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Enable logging for services with defined log rotation. These logs are useful for Incident Response and forensics investigation among other use cases.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html"
|
||||
"Text": "Enable **standard access logs** or **real-time logs** for all distributions.\n\nApply **least privilege** to log storage, enforce retention and immutability, and centralize ingestion with alerts.\n\nUse **defense-in-depth**: correlate with WAF metrics, sample real-time when needed, and audit new distributions for logging.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_logging_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"forensics-ready",
|
||||
"logging"
|
||||
],
|
||||
"DependsOn": [],
|
||||
|
||||
+21
-16
@@ -1,34 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_multiple_origin_failover_configured",
|
||||
"CheckTitle": "Check if CloudFront distributions have origin failover enabled.",
|
||||
"CheckTitle": "CloudFront distribution has origin failover configured with at least two origins",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"NIST 800-53 Controls"
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls",
|
||||
"Effects/Denial of Service"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AWSCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions have origin failover enabled.",
|
||||
"Risk": "Without origin failover, if the primary origin becomes unavailable, your CloudFront distribution may experience downtime, leading to potential service interruptions and a poor user experience.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_OriginGroup.html",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "**CloudFront distributions** are evaluated for an **origin group** configured with at least `2` origins to support automatic origin failover.",
|
||||
"Risk": "Without **origin failover**, the origin becomes a **single point of failure**. Origin outages, regional incidents, or targeted **DoS** can cause **downtime**, elevated error rates, and latency, degrading **availability** and impacting user experience and SLAs.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html#concept_origin_groups.creating",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-4",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/origin-failover-enabled.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-4",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/origin-failover-enabled.html"
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add OriginGroups with two origins and FailoverCriteria, then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: Add an origin group with two origins and use it in the default cache behavior\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n Quantity: 2\n Items:\n - Id: primary\n DomainName: <primary_origin_domain>\n S3OriginConfig: {}\n - Id: secondary\n DomainName: <secondary_origin_domain>\n S3OriginConfig: {}\n OriginGroups:\n Quantity: 1\n Items:\n - Id: <example_origin_group_id> # Critical: define origin group with 2 origins\n FailoverCriteria:\n StatusCodes:\n Quantity: 1\n Items: [500] # Critical: fail over on 500 to enable origin failover\n Members:\n Quantity: 2\n Items:\n - OriginId: primary\n - OriginId: secondary\n DefaultCacheBehavior:\n TargetOriginId: <example_origin_group_id> # Critical: use the origin group for requests\n ViewerProtocolPolicy: allow-all\n ForwardedValues:\n QueryString: false\n Cookies:\n Forward: none\n```",
|
||||
"Other": "1. In the AWS Console, go to CloudFront and open your distribution\n2. Select the Origins tab and ensure two origins exist; add a second origin if needed\n3. In the Origin groups pane, click Create origin group\n4. Select the two origins; set one as primary and the other as secondary\n5. Choose at least one failover status code (e.g., 500) and create the group\n6. Go to Behaviors, edit the relevant cache behavior (or Default behavior)\n7. Set Origin to the new origin group and save changes\n8. Deploy/confirm the distribution update",
|
||||
"Terraform": "```hcl\n# Configure an origin group with two origins and use it in the default cache behavior\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n\n origin {\n domain_name = \"<primary_origin_domain>\"\n origin_id = \"primary\"\n s3_origin_config {}\n }\n\n origin {\n domain_name = \"<secondary_origin_domain>\"\n origin_id = \"secondary\"\n s3_origin_config {}\n }\n\n origin_group {\n origin_id = \"<example_origin_group_id>\" # Critical: define origin group with 2 origins\n failover_criteria {\n status_codes = [500] # Critical: fail over on 500 to enable origin failover\n }\n member { origin_id = \"primary\" }\n member { origin_id = \"secondary\" }\n }\n\n default_cache_behavior {\n target_origin_id = \"<example_origin_group_id>\" # Critical: use the origin group for requests\n viewer_protocol_policy = \"allow-all\"\n forwarded_values {\n query_string = false\n cookies { forward = \"none\" }\n }\n }\n\n restrictions {\n geo_restriction { restriction_type = \"none\" }\n }\n\n viewer_certificate { cloudfront_default_certificate = true }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure origin failover in your CloudFront distribution by setting up an origin group with at least two origins to enhance availability and ensure traffic is redirected if the primary origin fails.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html#concept_origin_groups.creating"
|
||||
"Text": "Enable **origin failover** by defining an origin group with primary and secondary origins. Distribute origins across independent zones or providers, set clear failover criteria (e.g., HTTP codes/timeouts), monitor health, and routinely test failover. Align with **resilience** and **defense-in-depth** to protect availability.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_multiple_origin_failover_configured"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"redundancy"
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+27
-14
@@ -1,29 +1,42 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_origin_traffic_encrypted",
|
||||
"CheckTitle": "Check if CloudFront distributions encrypt traffic to custom origins.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution encrypts traffic to custom origins",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices/Network Security",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AWSCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions encrypt traffic to custom origins.",
|
||||
"Risk": "Allowing unencrypted HTTP traffic between CloudFront and custom origins can expose data to potential eavesdropping and manipulation, compromising data security and integrity.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/custom-origin-with-cloudfront.html",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "**CloudFront distributions** are evaluated for **TLS to origins**. The check ensures custom origins use `origin_protocol_policy`=`https-only`, or `match-viewer` only when the viewer protocol policy disallows HTTP. For S3 origins, it inspects the viewer protocol policy and flags `allow-all` as permitting non-encrypted paths.",
|
||||
"Risk": "Unencrypted origin links enable on-path interception and manipulation. Secrets, cookies, and PII can be exposed, and responses altered, undermining **confidentiality** and **integrity**. This increases chances of session hijacking, cache poisoning, and malicious content injection.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-traffic-to-origin-unencrypted.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-9",
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html",
|
||||
"https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/custom-origin-with-cloudfront.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-9",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-traffic-to-origin-unencrypted.html"
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change Origins[].CustomOriginConfig.OriginProtocolPolicy to https-only', then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: set CloudFront origin to use HTTPS only\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - Id: <example_origin_id>\n DomainName: <example_origin_domain>\n CustomOriginConfig:\n OriginProtocolPolicy: https-only # FIX: Force CloudFront-to-origin over HTTPS only\n DefaultCacheBehavior:\n TargetOriginId: <example_origin_id>\n ViewerProtocolPolicy: allow-all\n ForwardedValues:\n QueryString: false\n```",
|
||||
"Other": "1. In the AWS Console, open CloudFront and select your distribution\n2. Go to the Origins tab, select the custom origin, and click Edit\n3. Set Protocol to HTTPS only (Origin protocol policy = HTTPS Only)\n4. Click Save changes and wait for the distribution to deploy",
|
||||
"Terraform": "```hcl\n# Terraform: set CloudFront origin to use HTTPS only\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n\n origin {\n domain_name = \"<example_origin_domain>\"\n origin_id = \"<example_origin_id>\"\n\n custom_origin_config {\n http_port = 80\n https_port = 443\n origin_protocol_policy = \"https-only\" # FIX: Force CloudFront-to-origin over HTTPS only\n origin_ssl_protocols = [\"TLSv1.2\"]\n }\n }\n\n default_cache_behavior {\n target_origin_id = \"<example_origin_id>\"\n viewer_protocol_policy = \"allow-all\"\n forwarded_values {\n query_string = false\n cookies { forward = \"none\" }\n }\n }\n\n restrictions { geo_restriction { restriction_type = \"none\" } }\n viewer_certificate { cloudfront_default_certificate = true }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure your CloudFront distributions to require HTTPS (TLS) for traffic to custom origins, ensuring all data transmitted between CloudFront and the origin is encrypted and protected from unauthorized access.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html"
|
||||
"Text": "Enforce end-to-end HTTPS. Set `origin_protocol_policy` to `https-only` and viewer policy to `https-only` or `redirect-to-https`. Use trusted certificates and modern TLS (`TLSv1.2+`), disabling weak protocols. Apply **least privilege** and **defense in depth** by restricting direct origin access and preferring private connectivity.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_origin_traffic_encrypted"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"encryption"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+24
-14
@@ -1,31 +1,41 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_s3_origin_access_control",
|
||||
"CheckTitle": "Check if CloudFront distributions with S3 origin use OAC.",
|
||||
"CheckTitle": "CloudFront distribution uses Origin Access Control (OAC) for all S3 origins",
|
||||
"CheckType": [
|
||||
"Data Exposure"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Effects/Data Exposure"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AWSCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions use origin access control.",
|
||||
"Risk": "Without OAC, your S3 bucket could be accessed directly, bypassing CloudFront, which could expose your content to unauthorized access. Additionally, relying on Origin Access Identity (OAI) may limit functionality and security features, making your distribution less secure and more difficult to manage.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#migrate-from-oai-to-oac",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "**CloudFront distributions** with **Amazon S3 origins** are expected to use **Origin Access Control** (`OAC`) on each S3 origin.\n\nThe evaluation inspects distributions that include `s3_origin_config` and identifies S3 origins that lack an associated OAC.",
|
||||
"Risk": "Without **OAC**, S3 objects can be reached outside CloudFront, bypassing edge controls and weakening **confidentiality** and **integrity**.\n- Direct access enables data exfiltration\n- Loss of WAF, rate-limiting, and detailed logging; cost abuse\n- Limited support for signed writes and **SSE-KMS**, increasing tampering risk",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/s3-origin.html",
|
||||
"https://repost.aws/knowledge-center/cloudfront-access-to-amazon-s3",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-13",
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/iam-policies/ensure-aws-cloudfromt-distribution-with-s3-have-origin-access-set-to-enabled/",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-13",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/s3-origin.html"
|
||||
"CLI": "aws cloudfront create-origin-access-control --origin-access-control-config '{Name\":\"<example_resource_name>\",\"SigningProtocol\":\"sigv4\",\"SigningBehavior\":\"always\",\"OriginAccessControlOriginType\":\"s3\"}' && aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add OriginAccessControlId to S3 origins, then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: attach OAC to S3 origin in a CloudFront distribution\nResources:\n ExampleOAC:\n Type: AWS::CloudFront::OriginAccessControl\n Properties:\n OriginAccessControlConfig:\n Name: <example_resource_name>\n OriginAccessControlOriginType: s3\n SigningBehavior: always\n SigningProtocol: sigv4\n\n ExampleDistribution:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - Id: s3-<example_resource_id>\n DomainName: <example_bucket>.s3.amazonaws.com\n OriginAccessControlId: !Ref ExampleOAC # CRITICAL: attaches OAC to the S3 origin to satisfy the check\n S3OriginConfig:\n OriginAccessIdentity: \"\" # CRITICAL: disable OAI when using OAC\n DefaultCacheBehavior:\n TargetOriginId: s3-<example_resource_id>\n ViewerProtocolPolicy: redirect-to-https\n CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6\n```",
|
||||
"Other": "1. In the AWS Console, open CloudFront and go to Security > Origin access > Origin access control (OAC). Click Create control setting, choose Origin type S3, keep Sign requests, and create the OAC.\n2. Open your CloudFront distribution, go to the Origins tab.\n3. For each S3 origin: click Edit, select Origin access control settings (recommended), choose the OAC created in step 1, and Save changes.\n4. Repeat step 3 for all S3 origins in the distribution.",
|
||||
"Terraform": "```hcl\n# Terraform: attach OAC to S3 origin in a CloudFront distribution\nresource \"aws_cloudfront_origin_access_control\" \"oac\" {\n name = \"<example_resource_name>\"\n origin_access_control_origin_type = \"s3\"\n signing_behavior = \"always\"\n signing_protocol = \"sigv4\"\n}\n\nresource \"aws_cloudfront_distribution\" \"dist\" {\n enabled = true\n\n origin {\n domain_name = \"<example_bucket>.s3.amazonaws.com\"\n origin_id = \"s3-<example_resource_id>\"\n\n origin_access_control_id = aws_cloudfront_origin_access_control.oac.id # CRITICAL: attaches OAC to the S3 origin to satisfy the check\n\n s3_origin_config {\n origin_access_identity = \"\" # CRITICAL: disable OAI when using OAC\n }\n }\n\n default_cache_behavior {\n target_origin_id = \"s3-<example_resource_id>\"\n viewer_protocol_policy = \"redirect-to-https\"\n cache_policy_id = \"658327ea-f89d-4fab-a63d-7e88639e58f6\"\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure Origin Access Control (OAC) for CloudFront distributions that use an Amazon S3 origin. This will ensure that the content in your S3 bucket is accessible only through the specified CloudFront distribution, enhancing security by preventing direct access to the bucket.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html"
|
||||
"Text": "Enable **Origin Access Control** for all S3 origins and keep buckets non-public.\n\nApply **least privilege**: scope bucket and key permissions to CloudFront and the intended distribution. Ensure origin requests are signed, migrate from legacy OAI, and use **defense in depth** with WAF and monitoring to protect and observe access.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_s3_origin_access_control"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
+18
-11
@@ -1,32 +1,39 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_s3_origin_non_existent_bucket",
|
||||
"CheckTitle": "CloudFront distributions should not point to non-existent S3 origins without static website hosting.",
|
||||
"CheckTitle": "CloudFront distribution S3 origins reference existing buckets",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "This control checks whether Amazon CloudFront distributions are pointing to non-existent Amazon S3 origins without static website hosting. The control fails if the origin is configured to point to a non-existent bucket.",
|
||||
"Risk": "Pointing a CloudFront distribution to a non-existent S3 bucket can allow malicious actors to create the bucket and potentially serve unauthorized content through your distribution, leading to security and integrity issues.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/s3-origin-with-cloudfront.html",
|
||||
"Description": "**CloudFront distributions** with `S3OriginConfig` should reference existing **S3 bucket origins** (excluding static website hosting).\n\nIdentifies origins where the configured bucket name does not exist.",
|
||||
"Risk": "**Dangling S3 origins** allow potential **bucket takeover**: an attacker could create the missing bucket and have CloudFront retrieve attacker-controlled objects *if access isn't restricted*.\n\nThis threatens **integrity** (content spoofing, cache poisoning) and **availability** (errors/timeouts), undermining user trust.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/s3-origin-with-cloudfront.html",
|
||||
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-12",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-existing-s3-bucket.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-12",
|
||||
"Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-existing-s3-bucket.html"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: ensure the S3 bucket referenced by the CloudFront S3 origin exists\nResources:\n <example_resource_name>:\n Type: AWS::S3::Bucket\n Properties:\n BucketName: <example_resource_name> # Critical: must exactly match the bucket name used in the CloudFront origin's domain (before \".s3\") to make it exist\n```",
|
||||
"Other": "1. In the AWS console, open CloudFront and select the distribution\n2. Go to Origins, select the S3 origin, and note the Domain Name (the bucket name is the text before \".s3\")\n3. Open the S3 console, click Create bucket, enter the exact bucket name from step 2, and create the bucket\n4. Re-run the check",
|
||||
"Terraform": "```hcl\n# Ensure the S3 bucket referenced by the CloudFront S3 origin exists\nresource \"aws_s3_bucket\" \"<example_resource_name>\" {\n bucket = \"<example_resource_name>\" # Critical: must exactly match the bucket name used in the CloudFront origin's domain (before \".s3\")\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Verify that all CloudFront distributions are configured to point to valid, existing S3 buckets. Update the origin settings as needed to ensure that your distributions are linked to appropriate and secure origins.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HowToUpdateDistribution.html"
|
||||
"Text": "Ensure origins reference valid, owned buckets; delete or update stale references. Enforce **origin access control** (or OAI) and tight bucket policies so only the distribution can access objects. Apply **least privilege**, manage bucket names, and monitor origin health to prevent misrouting.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_s3_origin_non_existent_bucket"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"trustboundaries"
|
||||
"resilience"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+20
-12
@@ -1,26 +1,34 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_using_deprecated_ssl_protocols",
|
||||
"CheckTitle": "Check if CloudFront distributions are using deprecated SSL protocols.",
|
||||
"CheckType": [],
|
||||
"CheckTitle": "CloudFront distribution does not use SSLv3, TLSv1, or TLSv1.1 for origin connections",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "low",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions are using deprecated SSL protocols.",
|
||||
"Risk": "Using insecure ciphers could affect privacy of in transit information.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html",
|
||||
"Description": "CloudFront distributions have origins whose `OriginSslProtocols` allow **deprecated SSL/TLS versions** (`SSLv3`, `TLSv1`, `TLSv1.1`) for CloudFront-to-origin HTTPS connections.",
|
||||
"Risk": "Weak protocols between CloudFront and the origin allow downgrades and known exploits (e.g., POODLE/BEAST), enabling eavesdropping or content tampering. This compromises the **confidentiality** and **integrity** of data in transit, exposing cookies, credentials, and responses served to viewers.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html",
|
||||
"https://trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-insecure-origin-ssl-protocols.html",
|
||||
"https://support.icompaas.com/support/solutions/articles/62000223404-ensure-cloudfront-distributions-are-not-using-deprecated-ssl-protocols"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://docs.prowler.com/checks/aws/networking-policies/networking_33",
|
||||
"Terraform": ""
|
||||
"CLI": "aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change Origins[].CustomOriginConfig.OriginSslProtocols to [TLSv1.2], then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query \"ETag\" --output text)'",
|
||||
"NativeIaC": "```yaml\n# CloudFormation: set origin to allow only TLSv1.2 when connecting to the origin\nResources:\n <example_resource_name>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - Id: <example_origin_id>\n DomainName: <origin.example.com>\n CustomOriginConfig:\n OriginProtocolPolicy: https-only\n OriginSslProtocols:\n - TLSv1.2 # CRITICAL: restrict origin SSL protocols to TLSv1.2 to remove SSLv3/TLSv1/TLSv1.1\n DefaultCacheBehavior:\n TargetOriginId: <example_origin_id>\n ViewerProtocolPolicy: redirect-to-https\n```",
|
||||
"Other": "1. Open the AWS Console and go to CloudFront\n2. Select the distribution and open the Origins tab\n3. Select the custom origin and click Edit\n4. Under Origin SSL protocols, select only TLSv1.2\n5. Save changes\n6. Repeat for any other custom origins in the distribution",
|
||||
"Terraform": "```hcl\n# Terraform: set origin to allow only TLSv1.2 when connecting to the origin\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n enabled = true\n\n origin {\n domain_name = \"<origin.example.com>\"\n origin_id = \"<example_origin_id>\"\n\n custom_origin_config {\n http_port = 80\n https_port = 443\n origin_protocol_policy = \"https-only\"\n origin_ssl_protocols = [\"TLSv1.2\"] # CRITICAL: restrict origin SSL protocols to TLSv1.2\n }\n }\n\n default_cache_behavior {\n target_origin_id = \"<example_origin_id>\"\n viewer_protocol_policy = \"redirect-to-https\"\n allowed_methods = [\"GET\", \"HEAD\"]\n cached_methods = [\"GET\", \"HEAD\"]\n forwarded_values { query_string = false }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use a Security policy with ciphers that are as strong as possible. Drop legacy and insecure ciphers.",
|
||||
"Url": "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html"
|
||||
"Text": "Enforce **TLS 1.2+** for CloudFront-to-origin traffic. Remove `SSLv3`, `TLSv1`, `TLSv1.1` from allowed protocols and prefer modern cipher suites. Verify origin compatibility, update certificates and libraries, and periodically review policies as part of **defense in depth** and **least privilege**.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_using_deprecated_ssl_protocols"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
|
||||
+21
-12
@@ -1,31 +1,40 @@
|
||||
{
|
||||
"Provider": "aws",
|
||||
"CheckID": "cloudfront_distributions_using_waf",
|
||||
"CheckTitle": "Check if CloudFront distributions are using WAF.",
|
||||
"CheckTitle": "CloudFront distribution uses an AWS WAF web ACL",
|
||||
"CheckType": [
|
||||
"IAM"
|
||||
"Software and Configuration Checks/AWS Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
|
||||
"Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS"
|
||||
],
|
||||
"ServiceName": "cloudfront",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "arn:partition:cloudfront:region:account-id:distribution/resource-id",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "AwsCloudFrontDistribution",
|
||||
"Description": "Check if CloudFront distributions are using WAF.",
|
||||
"Risk": "Potential attacks and / or abuse of service, more even for even for internet reachable services.",
|
||||
"RelatedUrl": "https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html",
|
||||
"Description": "**CloudFront distributions** are assessed for an associated **AWS WAF** web ACL that inspects and filters HTTP/S requests at the edge.\n\nThe finding highlights distributions without this web ACL association.",
|
||||
"Risk": "Absent **WAF** on Internet-facing distributions exposes apps to layer-7 threats: SQLi/XSS and bot abuse can cause data exfiltration (**confidentiality**), unauthorized actions (**integrity**), and request floods that overload origins (**availability**). It may also raise egress and compute costs.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://repost.aws/questions/QUTY5hPVxgS6Caa3eZHX7-nQ/waf-on-alb-or-cloudfront",
|
||||
"https://docs.aws.amazon.com/waf/latest/developerguide/cloudfront-features.html",
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-integrated-with-waf.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_27#cloudformation",
|
||||
"Other": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_27",
|
||||
"Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_27#terraform"
|
||||
"NativeIaC": "```yaml\n# CloudFormation: associate an AWS WAFv2 Web ACL with a CloudFront distribution\nResources:\n <example_distribution>:\n Type: AWS::CloudFront::Distribution\n Properties:\n DistributionConfig:\n Enabled: true\n Origins:\n - Id: origin1\n DomainName: <example_origin_domain>\n S3OriginConfig: {}\n DefaultCacheBehavior:\n TargetOriginId: origin1\n ViewerProtocolPolicy: redirect-to-https\n ForwardedValues:\n QueryString: false\n WebACLId: <example_web_acl_arn> # CRITICAL: Associates the WAFv2 Web ACL (ARN) to this distribution\n # This makes the distribution PASS by enabling WAF protection\n```",
|
||||
"Other": "1. In the AWS Console, go to CloudFront > Distributions and select your distribution\n2. Click Edit (General/Settings)\n3. Set AWS WAF Web ACL to your Web ACL (scope: Global/CloudFront)\n4. Click Save/Yes, Edit and wait for Deployment to complete\n5. If no Web ACL exists: go to WAF & Shield > Web ACLs (scope: CloudFront), Create web ACL, then repeat steps 1-4 to associate it",
|
||||
"Terraform": "```hcl\n# Add this to the existing CloudFront distribution resource\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n web_acl_id = \"<example_web_acl_arn>\" # CRITICAL: Associates the WAFv2 Web ACL (ARN) to the distribution to PASS the check\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Use AWS WAF to protect your service from common web exploits. These could affect availability and performance, compromise security, or consume excessive resources.",
|
||||
"Url": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/cloudfront-integrated-with-waf.html"
|
||||
"Text": "Associate each distribution with an **AWS WAF web ACL** and apply defense-in-depth:\n- Use managed rule groups and rate limits\n- Add IP/geo and bot controls as needed\n- Enable logging, test new rules in `count` mode, and tune\n- Monitor metrics and update rules\n\nAlign controls with **least privilege** for requests.",
|
||||
"Url": "https://hub.prowler.com/check/cloudfront_distributions_using_waf"
|
||||
}
|
||||
},
|
||||
"Categories": [],
|
||||
"Categories": [
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
"Notes": ""
|
||||
|
||||
Reference in New Issue
Block a user