Question 1

Is default_cache_behavior enforced for PCI DSS v4.0?

Accepted Answer

Yes, This control checks whether an AWS CloudFront distribution requires viewers to use HTTPS directly or whether it uses redirection. The control fails if ViewerProtocolPolicy is set to allow-all for defaultCacheBehavior or for cacheBehaviors.

Question 2

Is logging_config enforced for PCI DSS v4.0?

Accepted Answer

Yes, This control checks if AWS CloudFront distributions are configured to capture information from AWS Simple Storage Service (AWS S3) server access logs. This rule is non-compliant if a CloudFront distribution does not have logging configured.

Question 3

Is viewer_certificate enforced for PCI DSS v4.0?

Accepted Answer

Yes, This control checks if AWS CloudFront distributions are using a custom SSL/TLS certificate and are configured to use SNI to serve HTTPS requests. This control fails if a custom SSL/TLS certificate is associated but the SSL/TLS support method is a dedicated IP address.

Question 4

Is web_acl_id enforced for PCI DSS v4.0?

Accepted Answer

Yes, This control checks whether CloudFront distributions are associated with either AWS WAF or AWS WAFv2 web ACLs. The control fails if the distribution is not associated with a web ACL.

Control	Clause	Change
CloudFront distributions should require encryption in transitcloudfront_distribution_encryption_in_transit_enabled 1.2.5	1.2.5
CloudFront distributions access logs should be enabledcloudfront_distribution_logging_enabled 5.3.4	5.3.4
CloudFront distributions should use SNI to serve HTTPS requestscloudfront_distribution_sni_enabled 1.2.5	1.2.5
CloudFront distributions should use custom SSL/TLS certificatescloudfront_distribution_use_custom_ssl_certificate 1.2.8	1.2.8
CloudFront distributions should have AWS WAF enabledcloudfront_distribution_waf_enabled 1.2.8	1.2.8

Controls