Cloudfront HTTP allowed

Using plain HTTP is insecure, as it transmits data in an unencrypted and readable format. This weakness exposes data to potential eavesdropping.

Recommendation

Only allow HTTPS for CloudFront. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#viewer_protocol_policy

Metadata

Severity: informational
Slug: cloudfront-http-allowed

CWEs

319: Cleartext Transmission of Sensitive Information

Available Labs

Open Aws labs in SecDim Play for this vulnerability.

easy

Cloudfront.aws

Other Easy AWS Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.