CloudFront Edge Security

What it is

Amazon CloudFront is a content delivery network (CDN) that serves content from edge locations close to users. It is also an edge security layer: it terminates TLS, absorbs traffic spikes, hides the origin and is the place to attach AWS WAF (Web Application Firewall).

The security design question is always the same: how do you make sure users reach your content only through CloudFront, and only the right users get private content?

How it works

Protecting an S3 origin

Use origin access control (OAC). CloudFront signs its requests to S3 using SigV4 (the AWS request signing method), and the bucket policy trusts only the CloudFront service principal for your distribution. Keep Block Public Access on.

{
  "Version": "2012-10-17",
  "Statement": {
    "Sid": "AllowCloudFrontServicePrincipalReadOnly",
    "Effect": "Allow",
    "Principal": { "Service": "cloudfront.amazonaws.com" },
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*",
    "Condition": { "StringEquals": { "AWS:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE" } }
  }
}

OAC replaces the older origin access identity (OAI). OAC supports SSE-KMS encrypted objects, and the KMS key policy must then allow the CloudFront service principal to use the key.

Protecting an ALB or custom origin

A custom origin is reachable on the internet unless you lock it down. Combine these controls.

• Allow the AWS managed prefix list for CloudFront origin facing addresses in the load balancer security group.
• Have CloudFront add a secret custom header, and make the ALB or WAF reject requests that lack it.
• Require HTTPS between CloudFront and the origin, with a valid certificate on the origin.
• Optionally use VPC origins, which let CloudFront reach an origin in a private subnet.

Restricting who can view content

Signed URLs and cookies use a trusted key group, which holds public keys that you upload. Prefer key groups to the older method that relies on the root user's CloudFront key pair. The distribution must have the behaviour set to require signed requests.

Signed URL expiry and source IP limits can be set per URL in a custom policy. A canned policy is simpler and sets only an expiry.

TLS settings

• Viewer protocol policy. Choose redirect HTTP to HTTPS or HTTPS only.
• Security policy. Set a minimum TLS version for viewers. Use a recent policy and avoid old protocol versions.
• Certificate. Use a certificate from AWS Certificate Manager (ACM). For CloudFront the certificate must be requested in us-east-1.
• Origin protocol policy. Use HTTPS only to protect the CloudFront to origin leg.
• Alternate domain names need a matching certificate, and SNI (Server Name Indication) is the usual and cheaper choice for serving them.

Field level encryption

Field level encryption encrypts chosen form fields at the edge with a public key, so that only the application holding the private key can decrypt them. Intermediate components, such as the web servers, see only ciphertext. Choose it to protect sensitive fields like card numbers from everything between the edge and a specific back end service.

Response headers and logging

A response headers policy adds security headers such as HSTS (HTTP Strict Transport Security), content security policy and frame options. Enable standard logging or real time logs to find abuse, and send WAF logs to a central place.

CloudFront and DDoS

Because CloudFront absorbs traffic at the edge and only forwards cache misses, it is a core part of DDoS resilient design. AWS Shield Standard protects CloudFront distributions automatically. Attach WAF rate based rules for layer 7 floods, and use Shield Advanced where you need extra protection and response support.