All checks
Medium
CloudFront distributions should encrypt traffic to custom origins
Checks that CloudFront encrypts traffic to each custom origin, so it cannot be read or altered between the edge and the origin. It fails on an origin set to HTTP only, or to Match viewer while any cache behavior on the distribution still allows HTTP.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Can break clients: Check that the origin answers on HTTPS first, with an unexpired certificate from a trusted CA that covers its Origin domain, or viewers get 502 errors.
- Replaces the resource: An S3 website endpoint origin cannot serve HTTPS, and the console will not change its Protocol: add the bucket's REST endpoint with origin access control, repoint behaviors, delete the old origin.
In the console
CloudFront → Distributions → the distribution → Origins → the origin → Edit
- Protocol
- HTTPS only on each custom origin, or Match viewer if every behavior requires HTTPS
See which of your accounts this check is failing on.
Book a live scan