CloudFront distribution allowing HTTP
A CDN that will happily serve your site unencrypted, with no logging.
Press Run. The stack loaded here fails in a way worth seeing.
▸What the engine finds7 findings
Not examples — CloudFront distribution allowing HTTP was run through the real engine when this page was built, and this is what it returned.
ViewerProtocolPolicy is allow-all — plain HTTP is served as-is.INTENT
▸ 6 informational findings — no geo restriction, distribution has no, access logging is
No geo restrictionAwsSolutions-CFR1Cdn
The CloudFront distribution may require Geo restrictions. Geo restriction may need to be enabled for the distribution in order to allow or deny a country in order to allow or restrict users in specific locations from accessing content.
Full rule text
The CloudFront distribution may require Geo restrictions. Geo restriction may need to be enabled for the distribution in order to allow or deny a country in order to allow or restrict users in specific locations from accessing content.
Distribution has no WAFAwsSolutions-CFR2Cdn
The CloudFront distribution may require integration with AWS WAF. The Web Application Firewall can help protect against application-layer attacks that can compromise the security of the system or place unnecessary load on them.
Full rule text
The CloudFront distribution may require integration with AWS WAF. The Web Application Firewall can help protect against application-layer attacks that can compromise the security of the system or place unnecessary load on them. AwsSolutions-CFR2 guide →
Access logging is offAwsSolutions-CFR3Cdn
The CloudFront distribution does not have access logging enabled. Enabling access logs helps operators track all viewer requests for the content delivered through the Content Delivery Network.
Full rule text
The CloudFront distribution does not have access logging enabled. Enabling access logs helps operators track all viewer requests for the content delivered through the Content Delivery Network.
Allows insecure TLS versionsAwsSolutions-CFR4Cdn
The CloudFront distribution allows for SSLv3 or TLSv1 for HTTPS viewer connections. Vulnerabilities have been and continue to be discovered in the deprecated SSL and TLS protocols. Help protect viewer connections by specifying a viewer certificate that enforces a minimum of TLSv1.1 or TLSv1.2 in the security policy. Distributions that use the default CloudFront viewer certificate or use 'vip' for the 'SslSupportMethod' are non-compliant with this rule, as the minimum security policy is set to TLSv1 regardless of the specified 'MinimumProtocolVersion'.
Full rule text
The CloudFront distribution allows for SSLv3 or TLSv1 for HTTPS viewer connections. Vulnerabilities have been and continue to be discovered in the deprecated SSL and TLS protocols. Help protect viewer connections by specifying a viewer certificate that enforces a minimum of TLSv1.1 or TLSv1.2 in the security policy. Distributions that use the default CloudFront viewer certificate or use 'vip' for the 'SslSupportMethod' are non-compliant with this rule, as the minimum security policy is set to TLSv1 regardless of the specified 'MinimumProtocolVersion'.
No server access logsAwsSolutions-S1Origin
Without server access logs there is no record of who read what. After an incident that is the difference between knowing what leaked and guessing.
Full rule text
The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket. AwsSolutions-S1 guide →
Requests not forced onto HTTPSAwsSolutions-S10OriginPolicy
Requests can arrive over plain HTTP, so object contents and any credentials in the request travel unencrypted across the network.
Full rule text
The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies. AwsSolutions-S10 guide →
Or start from a stack that fails interestingly
The single most common AI-generated CDK mistake: a bucket left open to the world.
SSH open to the entire internet — the classic copy-paste ingress rule.
Website hosting straight off a bucket — no CDN, no TLS, no access logging.
A database with storage encryption off and backups barely configured.
Action "*" on Resource "*" — the permission grant that ends incident reviews.
A REST API wired to Lambda, wide open, with no access logging.
Fast to write, impossible to restore — no PITR, no encryption choice.
A CDN that will happily serve your site unencrypted, with no logging.
A queue with no server-side encryption and no dead-letter queue.
Network traffic no one can reconstruct after the fact.
Six characters, no symbols, no MFA — defaults nobody revisited.
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.