All checks
High
CloudFront distributions should have a default root object configured
Checks that a CloudFront distribution with an S3 origin has a default root object, so a request for the root URL returns that object rather than passing to the origin, which can list the bucket's contents. It answers the root URL only: a request for a subfolder path still goes to the origin.
- service
- CloudFront
- severity
- High
- scope
- evaluated once per account
How to fix it
- Can break clients: Upload the object and let CloudFront read it first: if it is missing or unreadable, the root URL returns an error instead of what it returns now.
In the console
CloudFront → Distributions → the distribution → General → Settings → Edit
- Default root object
- The object for the root URL, such as index.html, with no leading slash: /index.html can return 403
See which of your accounts this check is failing on.
Book a live scan