cloudfront: Support for Field-Level Encryption in CloudFront BehaviorOptions

[meryemben92]

Describe the feature

I am requesting support for enabling field-level encryption in CloudFront BehaviorOptions within the AWS CDK. Recently, a high vulnerability issue has been raised: "CloudFront distributions that utilize HTTP POST Methods should have field-level encryption enabled."

However, currently, the AWS CDK does not support configuring field-level encryption directly in BehaviorOptions. This limitation requires the use of lower-level constructs (CfnDistribution), which complicates the setup and deviates from the convenience provided by the high-level Distribution construct.

Use Case

We need to secure sensitive data in HTTP POST requests by enabling field-level encryption in CloudFront distributions. Field-level encryption helps to protect specific data fields as they transit through CloudFront, ensuring compliance with security policies and protecting sensitive information.

Proposed Solution

Extend the BehaviorOptions in the aws-cloudfront module to include a property for field-level encryption, such as:

interface BehaviorOptions {
  ...
  fieldLevelEncryptionId?: string;
  ...
}

Other Information

Current Workaround

Currently, we have to define field-level encryption profiles and configurations using CfnResource and attach them to behaviors using the low-level CfnDistribution construct, which makes the code more complex and harder to maintain.

Example

Here’s an example of the current workaround:

export const createCloudFrontDistribution = (construct: Construct, distributionId: string) => {
  const bucket = new Bucket(construct, 'MyBucket');

  // Create a field-level encryption profile
  const fieldLevelEncryptionProfile = new CfnFieldLevelEncryptionProfile(
    construct,
    'MyFieldLevelEncryptionProfile',
    {
      encryptionEntities: {
        items: [
          {
            publicKeyId: 'your-public-key-id',
            providerId: 'provider-id',
            fieldPatterns: {
              items: ['field-to-encrypt'],
            },
          },
        ],
        quantity: 1,
      },
      name: 'MyFieldLevelEncryptionProfile',
    }
  );

  // Create a field-level encryption configuration
  const fieldLevelEncryptionConfig = new CfnFieldLevelEncryptionConfig(
    construct,
    'MyFieldLevelEncryptionConfig',
    {
      queryArgProfileConfig: {
        forwardWhenQueryArgProfileIsUnknown: true,
        queryArgProfiles: {
          items: [],
          quantity: 0,
        },
      },
      contentTypeProfileConfig: {
        forwardWhenContentTypeIsUnknown: false,
        contentTypeProfiles: {
          items: [],
          quantity: 0,
        },
      },
      fieldLevelEncryptionProfileId: fieldLevelEncryptionProfile.ref,
    }
  );

  // Create the high-level Distribution construct
  const distribution = new Distribution(construct, distributionId, {
    defaultBehavior: {
      origin: new origins.S3Origin(bucket),
      allowedMethods: AllowedMethods.ALLOW_ALL,
      viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
    },
  });

  // Attach the field-level encryption config to the default behavior
  const cfnDistribution = distribution.node.defaultChild as CfnDistribution;
  cfnDistribution.addOverride('Properties.DistributionConfig.DefaultCacheBehavior.FieldLevelEncryptionId', fieldLevelEncryptionConfig.ref);
};

Request

Please consider adding support for field-level encryption in the BehaviorOptions for CloudFront distributions in AWS CDK. This enhancement will greatly simplify securing sensitive data in our applications.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.141.0

Environment details (OS name and version, etc.)

OS: Ubuntu 22.04.4
Node.js: 18.18.2

[pahud]

Interesting. I can't find any document about how to create FieldLevelEncryptionConfig in CFN. Is CfnFieldLevelEncryptionConfig your custom construct? Can you share more info about this?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.