> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Origin Failover Should Be Enabled For CloudFront Distributions ### More Info: Origin Failover feature should be enabled for your Amazon CloudFront web distributions in order to improve the availability of the content delivered to your end users ### Risk Level Low ### Address Reliability, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * StateRAMP * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Origin Failover Should Be Enabled For CloudFront Distributions" for AWS using the AWS console, follow the below steps: 1. Log in to the AWS Management Console. 2. Go to the CloudFront service page. 3. Select the distribution for which you want to enable Origin Failover. 4. Click on the "Origins and Origin Groups" tab. 5. Select the origin for which you want to enable failover. 6. Click on the "Edit" button. 7. Scroll down to the "Origin Failover" section. 8. Click on the "Yes" radio button to enable Origin Failover. 9. Provide the alternate origin details in the "Alternate Domain Name" field. 10. Click on the "Create" button to create a new origin group. 11. Click on the "Save Changes" button to save the changes made. Once you have followed these steps, Origin Failover will be enabled for your CloudFront distribution. # To remediate the misconfiguration "Origin Failover Should Be Enabled For CloudFront Distributions" for AWS using AWS CLI, follow the steps below: 1. Open your terminal and ensure that AWS CLI is installed and configured. 2. Run the following command to list all the CloudFront distributions in your AWS account: ``` aws cloudfront list-distributions ``` 3. Identify the CloudFront distribution that needs to be remediated. 4. Run the following command to update the CloudFront distribution to enable origin failover: ``` aws cloudfront update-distribution --id --origin-failover-status-enabled ``` Replace `` with the actual ID of the CloudFront distribution. 5. Verify that origin failover has been enabled for the CloudFront distribution by running the following command: ``` aws cloudfront get-distribution --id --query 'Distribution.Origins.Items[].OriginFailoverCriteria.StatusCodes.Quantity' --output text ``` This command will return the number of status codes that are required to trigger a failover. If the output is greater than 0, it means that origin failover has been enabled for the CloudFront distribution. 6. Repeat the above steps for all the CloudFront distributions in your AWS account that need to be remediated. By following these steps, you can remediate the misconfiguration "Origin Failover Should Be Enabled For CloudFront Distributions" for AWS using AWS CLI. To remediate the misconfiguration "Origin Failover Should Be Enabled For CloudFront Distributions" for AWS using Python, you can follow the below steps: 1. Import the required AWS SDK libraries in your Python code. You will need `boto3` and `botocore` libraries. ``` import boto3 from botocore.exceptions import ClientError ``` 2. Create a `boto3` client for CloudFront. ``` cloudfront_client = boto3.client('cloudfront') ``` 3. Get the list of all the CloudFront distributions in your AWS account. ``` distributions = cloudfront_client.list_distributions()['DistributionList']['Items'] ``` 4. Loop through all the distributions and check if the "Origin Failover" is enabled or not. If it is not enabled, enable it. ``` for distribution in distributions: distribution_id = distribution['Id'] distribution_config = cloudfront_client.get_distribution_config(Id=distribution_id)['DistributionConfig'] if not distribution_config.get('Enabled', False): distribution_config['Enabled'] = True origin_failover_config = distribution_config.get('OriginFailoverSettings', {}) origin_failover_config['Enabled'] = True distribution_config['OriginFailoverSettings'] = origin_failover_config try: cloudfront_client.update_distribution(DistributionConfig=distribution_config, Id=distribution_id, IfMatch=distribution_config['ETag']) print(f'Origin Failover enabled for CloudFront distribution {distribution_id}') except ClientError as e: print(f'Error enabling Origin Failover for CloudFront distribution {distribution_id}: {e}') ``` 5. Run the Python script to enable the "Origin Failover" for all the CloudFront distributions in your AWS account. Once the script is successfully executed, the "Origin Failover" will be enabled for all the CloudFront distributions in your AWS account. ```hcl theme={null} resource "aws_cloudfront_distribution" "WEB_DISTRIBUTION" { # EXISTING REQUIRED SETTINGS (EXAMPLES – REPLACE WITH YOURS) enabled = true comment = "WEB_DISTRIBUTION_DESCRIPTION" default_root_object = "index.html" origins { origin_id = "primary-origin" domain_name = "PRIMARY_ORIGIN_DOMAIN_NAME" # e.g. myapp-primary.s3.amazonaws.com # Add any existing origin settings you already use (origin_access_control_id, custom_origin_config, etc.) s3_origin_config { origin_access_identity = "origin-access-identity/cloudfront/PRIMARY_OAI_ID" } } origins { origin_id = "failover-origin" domain_name = "FAILOVER_ORIGIN_DOMAIN_NAME" # e.g. myapp-failover.s3.amazonaws.com s3_origin_config { origin_access_identity = "origin-access-identity/cloudfront/FAILOVER_OAI_ID" } } origin_group { origin_id = "origin-group-with-failover" failover_criteria { status_codes = [500, 502, 503, 504] # adjust if your policy requires a different set } member { origin_id = "primary-origin" } member { origin_id = "failover-origin" } } default_cache_behavior { target_origin_id = "origin-group-with-failover" # USE THE ORIGIN GROUP, NOT A SINGLE ORIGIN viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] compress = true cache_policy_id = "CACHE_POLICY_ID" # replace with your cache policy ID origin_request_policy_id = "ORIGIN_REQUEST_POLICY_ID" # optional; replace if used } # ...all your existing distribution settings (viewer_certificate, restrictions, logging_config, etc.)... } ``` This change updates the existing `aws_cloudfront_distribution` in place (no forced replacement), though CloudFront will take time to propagate the new origin group configuration globally. To verify, `terraform plan` should show: * addition of an `origin_group` block with `failover_criteria` * `default_cache_behavior.target_origin_id` (and any other behaviors you update) pointing to that origin group instead of a single origin. ### Additional Reading: * [https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high\_availability\_origin\_failover.html](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html)