Question 1

Is default_cache_behavior enforced for Registry?

Accepted Answer

Yes, This control checks whether an AWS CloudFront distribution requires viewers to use HTTPS directly or whether it uses redirection. The control fails if ViewerProtocolPolicy is set to allow-all for defaultCacheBehavior or for cacheBehaviors.

Question 2

Is default_root_object enforced for Registry?

Accepted Answer

Yes, This control checks whether an AWS CloudFront distribution is configured to return a specific object that is the default root object. The control fails if the CloudFront distribution does not have a default root object configured.

Question 3

Is logging_config enforced for Registry?

Accepted Answer

Yes, This control checks if AWS CloudFront distributions are configured to capture information from AWS Simple Storage Service (AWS S3) server access logs. This rule is non-compliant if a CloudFront distribution does not have logging configured.

Question 4

Is viewer_certificate enforced for Registry?

Accepted Answer

Yes, This control checks if AWS CloudFront distributions are using a custom SSL/TLS certificate and are configured to use SNI to serve HTTPS requests. This control fails if a custom SSL/TLS certificate is associated but the SSL/TLS support method is a dedicated IP address.

Question 5

Is web_acl_id enforced for Registry?

Accepted Answer

Yes, This control checks whether CloudFront distributions are associated with either AWS WAF or AWS WAFv2 web ACLs. The control fails if the distribution is not associated with a web ACL.

AWS CloudFront Terraform module

Terraform Module Source