aws-cloudfront-exposed-to-internet

id: aws-cloudfront-exposed-to-internet
emits: ExposedToInternet
description: A Deployed CloudFront distribution is publicly reachable from the internet on its *.cloudfront.net
  domain (and any custom CNAME aliases).
applies_to:
- aws
match_record:
  resource_type: AWS::CloudFront::Distribution
  field: Distribution.Status
where:
- Distribution.Status == 'Deployed'
- Distribution.DistributionConfig.Enabled == true
emit:
  source_type: PublicEndpoint
  target_type: AnonymousIdentity
  source: <CloudFront distribution node>
  target: <AnonymousIdentity>
  state: ACTIVE
  permissions: []
  api_source: cloudfront:ListDistributions
  evidence_field: Distribution.DistributionConfig.Enabled
  conditions:
  - service_state
  state_logic: "ACTIVE when Distribution.Status == 'Deployed' AND Enabled == true. CONDITIONAL(service_state)\
    \ when Status == 'InProgress' (distribution is being deployed or modified \u2014 not yet serving traffic).\
    \ Do NOT downgrade to CONDITIONAL because of geo-restriction (HTTP 403 response, not TCP block) or\
    \ WAF (HTTP-layer filter, not network block). Do NOT emit when Enabled == false."
  derived_from:
  - Distribution.Status == 'Deployed' observation
  false_positive_note: "Geo-restriction (GeoRestriction.RestrictionType) blocks content by returning HTTP\
    \ 403 to blocked geographies but does NOT make the distribution TCP-unreachable from those regions.\
    \ ExposedToInternet remains ACTIVE. WAF Web ACL association (webACLId) filters at HTTP layer; also\
    \ does not change network exposure. A distribution with RequiredProtocols == TLSv1.2 is still internet-facing;\
    \ HTTPS- only enforcement does not change the ExposedToInternet fact. Signed URLs / signed cookies\
    \ (trusted signers / key groups configured) add auth at the HTTP layer \u2014 the distribution is\
    \ still TCP-reachable from the internet; keep ACTIVE with lower confidence (0.85) when signed-URL\
    \ enforcement is detected, since an anonymous HTTP request will receive a 403, not bypass."
  narrative: "CloudFront distribution {source.name} (domain: {DomainName}) is deployed and internet-facing.\
    \ Any user on the internet can send HTTPS requests to it. HTTP-layer controls (WAF, geo-restriction,\
    \ signed URLs) do not change network-level reachability \u2014 TCP connections from the internet are\
    \ accepted."