Question 1

Is default_cache_behavior enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, This control checks whether an AWS CloudFront distribution requires viewers to use HTTPS directly or whether it uses redirection. The control fails if ViewerProtocolPolicy is set to allow-all for defaultCacheBehavior or for cacheBehaviors.

Question 2

Is logging_config enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, This control checks if AWS CloudFront distributions are configured to capture information from AWS Simple Storage Service (AWS S3) server access logs. This rule is non-compliant if a CloudFront distribution does not have logging configured.

Question 3

Is web_acl_id enforced for AWS Well-Architected Framework v10?

Accepted Answer

Yes, This control checks whether CloudFront distributions are associated with either AWS WAF or AWS WAFv2 web ACLs. The control fails if the distribution is not associated with a web ACL.

AWS CloudFront Terraform module

Terraform Module Source