All checks
Medium
CloudFront distributions should require encryption in transit
Checks that every cache behavior on the CloudFront distribution, the default one and each path pattern, requires HTTPS or redirects HTTP to HTTPS, so traffic between viewers and CloudFront cannot be read or altered in transit. One behavior left on HTTP and HTTPS fails the distribution.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Can break clients: HTTPS only answers an http:// request with 403, so anything hard-coded to an http:// URL breaks; Redirect HTTP to HTTPS sends GET and HEAD a 301 to the HTTPS URL instead.
In the console
CloudFront → Distributions → the distribution → Behaviors → the behavior → Edit
- Viewer protocol policy
- Redirect HTTP to HTTPS or HTTPS only, on the default behavior and every path pattern
See which of your accounts this check is failing on.
Book a live scan