1. Login to the AWS Management Console.
2. Navigate to the CloudFront console.
3. Select the distribution(s) that you want to modify.
4. Click on the “Edit” button at the top of the page.
5. In the “General” tab, under the “Viewer Protocol Policy” section, select “Redirect HTTP to HTTPS”.
6. Click on the “Yes, Edit” button to save the changes.
7. Wait for the changes to propagate.

​

1. Login to your AWS account using AWS CLI.
2. Identify the CloudFront distributions that are not using HTTPS for secure delivery of web content. You can use the following command to list all the CloudFront distributions in your account:
   aws cloudfront list-distributions
   
3. Once you have identified the CloudFront distribution that is not using HTTPS, you can update it to use HTTPS by using the following command:
   aws cloudfront update-distribution --id <distribution_id> --distribution-config file://config.json
   
   Replace <distribution_id> with the ID of the CloudFront distribution that you want to update.
4. Create a JSON file named config.json and add the following code to it:
   {
       "Comment": "Update CloudFront distribution to use HTTPS",
       "Enabled": true,
       "ViewerCertificate": {
           "ACMCertificateArn": "<ACM_certificate_ARN>",
           "MinimumProtocolVersion": "TLSv1.2_2018",
           "SSLSupportMethod": "sni-only"
       },
       "Origins": {
           "Quantity": 1,
           "Items": [
               {
                   "Id": "<origin_id>",
                   "DomainName": "<origin_domain_name>",
                   "OriginPath": "",
                   "CustomHeaders": {
                       "Quantity": 0
                   },
                   "CustomOriginConfig": {
                       "HTTPPort": 80,
                       "HTTPSPort": 443,
                       "OriginProtocolPolicy": "https-only",
                       "OriginSslProtocols": {
                           "Quantity": 3,
                           "Items": [
                               "TLSv1",
                               "TLSv1.1",
                               "TLSv1.2"
                           ]
                       }
                   }
               }
           ]
       },
       "DefaultCacheBehavior": {
           "TargetOriginId": "<origin_id>",
           "ViewerProtocolPolicy": "redirect-to-https",
           "MinTTL": 0,
           "AllowedMethods": {
               "Quantity": 7,
               "Items": [
                   "HEAD",
                   "DELETE",
                   "POST",
                   "GET",
                   "OPTIONS",
                   "PUT",
                   "PATCH"
               ],
               "CachedMethods": {
                   "Quantity": 2,
                   "Items": [
                       "GET",
                       "HEAD"
                   ]
               }
           },
           "SmoothStreaming": false,
           "Compress": true,
           "LambdaFunctionAssociations": {
               "Quantity": 0
           }
       },
       "PriceClass": "PriceClass_All",
       "Enabled": true
   }
   
   Replace <ACM_certificate_ARN> with the ARN of the ACM certificate that you want to use for HTTPS. Replace <origin_id> with the ID of the CloudFront origin that you want to use for HTTPS. Replace <origin_domain_name> with the domain name of the CloudFront origin that you want to use for HTTPS.
5. Save the config.json file and run the aws cloudfront update-distribution command to update the CloudFront distribution to use HTTPS.
6. Verify that the CloudFront distribution is now using HTTPS by accessing the distribution’s URL in a web browser. The URL should start with https://.

1. First, import the necessary AWS SDK for Python (Boto3) libraries:

import boto3

2. Next, create a Boto3 client for CloudFront:

cloudfront = boto3.client('cloudfront')

3. Then, use the list_distributions() method to get a list of all CloudFront distributions:

response = cloudfront.list_distributions()

4. Loop through the distributions and check if they are using HTTPS:

for distribution in response['DistributionList']['Items']:
    if distribution['ViewerCertificate']['CertificateSource'] != 'cloudfront':
        print("Distribution {} is not using a CloudFront SSL certificate".format(distribution['Id']))
    elif distribution['ViewerCertificate']['MinimumProtocolVersion'] != 'TLSv1.2_2018':
        print("Distribution {} is not using TLSv1.2_2018".format(distribution['Id']))
    elif distribution['ViewerCertificate']['SSLSupportMethod'] != 'sni-only':
        print("Distribution {} is not using SNI-only SSL".format(distribution['Id']))
    else:
        print("Distribution {} is using HTTPS".format(distribution['Id']))

5. If a distribution is not using HTTPS, update its configuration using the update_distribution() method:

distribution_id = 'YOUR_DISTRIBUTION_ID'

response = cloudfront.get_distribution_config(Id=distribution_id)
config = response['DistributionConfig']

config['ViewerCertificate']['CloudFrontDefaultCertificate'] = True
config['ViewerCertificate']['MinimumProtocolVersion'] = 'TLSv1.2_2018'
config['ViewerCertificate']['SSLSupportMethod'] = 'sni-only'

response = cloudfront.update_distribution(DistributionConfig=config, Id=distribution_id, IfMatch=response['ETag'])

print("Distribution {} has been updated to use HTTPS".format(distribution_id))

resource "aws_cloudfront_distribution" "this" {
  enabled             = true
  comment             = "CLOUDFRONT_DISTRIBUTION_DESCRIPTION"
  default_root_object = "index.html"

  origin {
    domain_name = "CUSTOM_ORIGIN_DOMAIN_NAME" # e.g. app.example.com
    origin_id   = "CUSTOM_ORIGIN_ID"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only" # enforce HTTPS to the origin
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "CUSTOM_ORIGIN_ID"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn            = "ACM_CERTIFICATE_ARN"
    ssl_support_method             = "sni-only"
    minimum_protocol_version       = "TLSv1.2_2021"
  }
}

• CLOUDFRONT_DISTRIBUTION_DESCRIPTION with a description string.
• CUSTOM_ORIGIN_DOMAIN_NAME with your custom origin DNS name.
• CUSTOM_ORIGIN_ID with a unique ID for this origin.
• ACM_CERTIFICATE_ARN with the ARN of your ACM certificate in us-east-1.