Overview
In a modern cloud architecture, protecting data in transit is a non-negotiable security requirement. For organizations using Amazon Web Services (AWS), the CloudFront content delivery network (CDN) is a critical control point for distributing applications globally. The connection between your end-users and the CloudFront edge network is governed by a fundamental configuration: the Viewer Protocol Policy. This setting dictates whether your application will accept unencrypted HTTP traffic, a practice that introduces significant risk.
Allowing unencrypted connections exposes your users and your business to man-in-the-middle attacks, session hijacking, and data tampering. A misconfigured policy not only creates a security vulnerability but also leads to compliance failures and erodes customer trust. Properly configuring this policy is a foundational step in securing your content delivery and represents a high-impact, low-effort win for any team managing cloud resources.
Why It Matters for FinOps
From a FinOps perspective, weak security configurations are a form of operational waste that can lead to significant financial liabilities. Failing to enforce HTTPS on AWS CloudFront directly translates into business risk with clear cost implications. Non-compliance with standards like PCI DSS or HIPAA can result in steep regulatory fines and costly mandatory breach notifications. A security incident stemming from unencrypted traffic will inevitably incur expensive forensic analysis and remediation efforts.
Beyond direct costs, the impact on revenue can be substantial. Modern web browsers actively penalize sites that use HTTP by displaying “Not Secure” warnings, which increases bounce rates and drives away potential customers. Search engines also demote unencrypted sites in rankings, negatively affecting user acquisition. For FinOps practitioners, enforcing strong security guardrails like the Viewer Protocol Policy is not just a technical task; it’s a core practice for mitigating financial risk and protecting brand value.
What Counts as “Idle” in This Article
In the context of this security policy, we define a wasteful or “idle” configuration as any AWS CloudFront distribution that permits unencrypted traffic without enforcing a secure alternative. This refers specifically to the “HTTP and HTTPS” setting in the Viewer Protocol Policy.
This configuration creates security waste because it leaves the choice of using an encrypted connection up to the client or user, which is an anti-pattern for modern applications. The primary signal of this waste is a CloudFront cache behavior that is not set to either “Redirect HTTP to HTTPS” or “HTTPS Only.” This idle state of security represents an unaddressed vulnerability that can be easily eliminated to improve the overall health and cost-efficiency of your cloud environment.
Common Scenarios
Scenario 1: Public Websites
For marketing websites, e-commerce platforms, or portals served via CloudFront, users often type the domain name directly without specifying https://. To ensure a seamless and secure user experience, the recommended policy is Redirect HTTP to HTTPS. This automatically upgrades any insecure request to a secure one, protecting the user while preventing errors that could make the site appear unavailable.
Scenario 2: API Endpoints
When CloudFront serves as a gateway for REST APIs or mobile application backends, communication should always be encrypted. API clients are programmatic and should be configured correctly from the start. The best policy is HTTPS Only. This approach is stricter, immediately rejecting any unencrypted request with an error. This fails fast, forcing developers to correct insecure client configurations rather than allowing a potential vulnerability.
Scenario 3: Legacy Application Support
In rare cases, an organization may need to support legacy clients or IoT devices that cannot use modern encryption protocols. Allowing HTTP for these systems is a significant security trade-off. If unavoidable, this traffic should be isolated to a dedicated CloudFront distribution with strict access controls, such as IP allow-listing. This scenario represents a form of security debt that should be tracked and slated for remediation by upgrading the legacy clients.
Risks and Trade-offs
The primary risk of allowing unencrypted HTTP traffic is the exposure to man-in-the-middle (MITM) attacks, where an attacker can intercept, read, or modify data between the user and your application. This can lead to the theft of credentials, session cookies, and sensitive personal information. It also allows for content injection, where an attacker could insert malicious code or false information into your website.
The main trade-off when enforcing an HTTPS-only policy is the risk of breaking connectivity for outdated clients that do not support modern TLS. This “don’t break prod” concern is valid but often overstated for modern web traffic. A proper remediation plan includes auditing client traffic and conducting thorough testing before deploying the change. For the vast majority of applications, the security benefits of enforcing HTTPS far outweigh the minimal risk of impacting a small number of legacy clients.
Recommended Guardrails
To ensure consistent security and prevent misconfigurations, organizations should implement clear governance and automated guardrails around CloudFront deployments.
Start by establishing a policy that mandates all new CloudFront distributions enforce either “Redirect HTTP to HTTPS” or “HTTPS Only” by default. Use infrastructure-as-code (IaC) templates to bake this configuration into your standard deployment patterns.
Implement a robust tagging strategy to assign clear ownership for every CloudFront distribution, ensuring accountability for remediation. Leverage automated compliance tools to continuously scan your AWS environment for distributions that violate the policy. Configure automated alerts to notify the resource owner and the security team when a non-compliant configuration is detected, enabling rapid response and reducing the window of exposure.
Provider Notes
AWS
The core of this security control is the CloudFront Viewer Protocol Policy, which is configured within each cache behavior of a distribution. To ensure compliance, every behavior, including the default, must be set to either “Redirect HTTP to HTTPS” or “HTTPS Only.”
AWS provides native tools to help identify these misconfigurations. AWS Security Hub includes the control [CloudFront.3], which automatically checks if distributions require encryption in transit. For a more advanced security posture, you can implement HTTP Strict Transport Security (HSTS) headers using CloudFront’s Response Headers Policies, which instructs browsers to only communicate with your domain over HTTPS in the future.
Binadox Operational Playbook
Binadox Insight: Enforcing encryption for data in transit is not an optional feature; it is a foundational FinOps principle. Failing to do so creates unmanaged risk, which is a hidden cost that can dwarf infrastructure expenses in the event of a breach.
Binadox Checklist:
- Inventory all AWS CloudFront distributions and their associated cache behaviors.
- Identify and prioritize distributions that allow HTTP traffic, focusing on those handling sensitive data or public-facing applications.
- For each non-compliant behavior, update the Viewer Protocol Policy to “Redirect HTTP to HTTPS” or “HTTPS Only” based on the use case.
- Thoroughly test all associated applications to ensure no disruption to end-users or legacy clients.
- Implement an automated detection and alerting mechanism to prevent future policy violations.
- Document the HTTPS enforcement policy as a mandatory standard for all new deployments.
Binadox KPIs to Track:
- Percentage of CloudFront distributions that are 100% compliant with the HTTPS enforcement policy.
- Mean Time to Remediate (MTTR) for newly discovered non-compliant distributions.
- Number of security findings related to unencrypted data-in-transit across the environment.
- Reduction in user bounce rate on key landing pages after enabling HTTPS redirects.
Binadox Common Pitfalls:
- Updating only the default cache behavior and forgetting to update other custom behaviors in the same distribution.
- Selecting “HTTPS Only” for a general-purpose website, causing connection errors for users who type the domain manually.
- Failing to test how the change impacts legacy API clients or third-party integrations that may be hardcoded to use HTTP.
- Ignoring the risk for “non-sensitive” content, which can still be used as a vector for session hijacking or malware injection.
Conclusion
The CloudFront Viewer Protocol Policy is a simple yet powerful tool for securing your AWS-hosted applications. By moving away from permissive HTTP access and enforcing a strict HTTPS-only standard, you eliminate a major class of security vulnerabilities and align your organization with critical compliance frameworks. This is a crucial step in building a mature cloud security posture.
Take immediate action to audit your CloudFront distributions and remediate any that allow unencrypted traffic. By integrating this control into your standard operational playbooks and automated guardrails, you can ensure that your data and your users remain protected, turning a potential liability into a demonstrated security strength.
7-day free trial