Enabling HSTS for HTTPS traffic through CloudFront distribution

Question

Pulumi · Accepted Answer

To enable HTTP Strict Transport Security (HSTS) for HTTPS traffic through a CloudFront distribution, you can leverage the AWS CloudFront service to set up a distribution with an attached SSL/TLS certificate for secure communication.

HSTS is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections, and never via the insecure HTTP protocol.

In CloudFront, you can enforce the use of HTTPS by configuring the viewer protocol policy to redirect HTTP requests to HTTPS.

Here's how you can create a CloudFront distribution with HSTS using Pulumi with TypeScript:

1. **Set Up an SSL/TLS Certificate:** You would typically use the AWS Certificate Manager (ACM) to provision an SSL/TLS certificate.
2. **Create a CloudFront Distribution:** Configure the distribution to use the ACM certificate, set the `viewerProtocolPolicy` to enforce HTTPS, and include the `Strict-Transport-Security` header in the response headers policy.

Below is a Pulumi program that demonstrates creating a CloudFront distribution with the appropriate settings for HSTS:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as aws from '@pulumi/aws';

// Create a new ACM certificate (you would typically do this once and reference it)
const cert = new aws.acm.Certificate("cert", {
    domainName: "example.com", // Replace with your domain
    validationMethod: "DNS",
});

// Create a CloudFront distribution with the HSTS settings
const distribution = new aws.cloudfront.Distribution("myDistribution", {
    enabled: true,
    // Rest of the CloudFront distribution configuration...

viewerCertificate: {
        acmCertificateArn: cert.arn, // Reference the certificate ARN
        sslSupportMethod: "sni-only",
        minimumProtocolVersion: "TLSv1.2_2019",
    },

defaultCacheBehavior: {
        // Other cache behavior settings...

viewerProtocolPolicy: "redirect-to-https", // Enforce HTTPS by redirecting HTTP to HTTPS
    },

// Define the response headers policy including the HSTS header
    responseHeadersPolicyId: hstsHeaderPolicy.id,
});

// Create a response headers policy including the HSTS header
const hstsHeaderPolicy = new aws.cloudfront.ResponseHeadersPolicy("hstsHeaderPolicy", {
    securityHeadersConfig: {
        strictTransportSecurity: {
            override: true,
            includeSubdomains: true,
            preload: true,
            accessControlMaxAgeSec: 63072000, // Example of a two-year max age, as per HSTS preload requirements
        },
        // You can add additional headers here if needed...
    },
});

// Export the distribution domain name
export const distributionDomainName = distribution.domainName;
```

**Explanation of Key Configuration:**

- `cert`: Represents the ACM certificate needed for HTTPS. In a real-world scenario, you would provision your certificates separately from the distribution creation to ensure they can be validated and are ready for use.

- `myDistribution`: The CloudFront distribution configured for HSTS. Notice the `viewerProtocolPolicy` field is set to `"redirect-to-https"`, which will force the use of HTTPS for requests.

- `hstsHeaderPolicy`: This is the custom response headers policy containing the HSTS header configuration.

Please note:

- ACM certificates need a manual validation step out of the scope of this script. DNS validation records must be added to your domain's DNS configuration to complete the process.
- The `viewerProtocolPolicy` is set to enforce HTTPS only. This setting makes sure that even if a request comes in over HTTP, it will be redirected to HTTPS.
- The `Strict-Transport-Security` header is set in the `hstsHeaderPolicy` with the appropriate values. The `preload` option is something you would set if you want your site to be preloaded into HSTS lists that browsers use.

After creating your distribution with Pulumi, it would push the new configuration to your AWS account. You can then ensure that HSTS is enforced for your CloudFront distribution, helping secure your application against a range of SSL/TLS vulnerabilities and attacks.