Check provider logo

CloudFront distribution has a default root object configured

cloudfront_distributions_default_root_object

Severityhigh
Servicecloudfront
by Prowler

CloudFront distributions are evaluated for a configured default root object that maps / requests to a specific file such as index.html, rather than forwarding root requests directly to the origin.

Risk

Without a default root object, root requests can reveal origin listings or unintended files, exposing data (confidentiality) and aiding reconnaissance. They may also return errors, lowering uptime (availability), or route unpredictably, risking wrong content delivery (integrity).

Run this check with Prowler CLI

prowler aws --checks cloudfront_distributions_default_root_object

Run in Prowler Cloud

Recommendation

Set a default root object that returns a safe landing page (e.g., index.html). Apply defense in depth: restrict direct origin access, define explicit error pages, and standardize redirects. Test root and subdirectory requests for predictable responses. Align origin permissions with least privilege.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add DefaultRootObject: "index.html", then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Native IaC
Terraform
Other
  1. Open the AWS Console and go to CloudFront
  2. Select the target distribution and choose Settings > General > Edit
  3. In Default root object, enter index.html (do not start with a /)
  4. Save changes and wait for deployment to complete

Source Code

Resource Type

AwsCloudFrontDistribution

References