---
title: "Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication"
canonical: "https://kb.cynergy.app/space/MD/991592848/Ensure%20AWS%20CloudFront%20distribution%20is%20using%20secure%20SSL%20protocols%20for%20HTTPS%20communication"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_5  
Severity: LOW

# AWS CloudFront distribution is using insecure SSL protocols for HTTPS communication

# Description

DynamoDB point-in-time recovery (PITR) is an automatic backup service for DynamoDB table data that helps protect your DynamoDB tables from accidental write or delete operations. It must use HTTPS. Once enabled, PITR provides continuous backups that can be controlled using various programmatic parameters. PITR can also be used to restore table data from any point in time during the last 35 days, as well as any incremental backups of DynamoDB tables.

We recommend you ensure Cloudfront distribution ViewerProtocolPolicy is set to HTTPS.

# Fix - Runtime

## AWS Console

To change the policy using the AWS Console, follow these steps:

1. Log in to the AWS Management Console at <u>[https://console.aws.amazon.com/](https://console.aws.amazon.com/)</u>.
2. Open the <u>**[Amazon DynamoDB console](https://console.aws.amazon.com/dynamodb/)**</u>.
3. Navigate to your **DynamoDB **table, then select the **Backups** tab.
4. To turn the feature on, click **Enable**.  
The **Earliest restore date** and **Latest restore date** are visible within a few seconds.

## CLI Command

To update a CloudFront distribution:

Shell

```shell
aws cloudfront update-distribution \
    --id EMLARXS9EXAMPLE \
    --if-match E2QWRUHEXAMPLE \
    --distribution-config file://dist-config-disable.json
    --ViewerProtocolPolicy https-only

```

# Fix - Build time

## Terraform

- **Resource**: aws_cloudfront_distribution
- **Argument**: viewer_protocol_policy (Required) - Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of allow-all, https-only, or redirect-to-https.

Go

```go
resource "aws_cloudfront_distribution" "s3_distribution" {
  ...
  origin {
    domain_name = aws_s3_bucket.b.bucket_regional_domain_name
    origin_id   = local.s3_origin_id
    }
+ viewer_protocol_policy = "https-only"
    ...
  }

```