Question

A healthcare company operates a public web application behind CloudFront and an Application Load Balancer. A form collects patients' credit card numbers and Social Security numbers. Compliance requires that these specific fields remain encrypted from the moment they enter the AWS edge, so that even the application servers and downstream microservices cannot read them — only a dedicated payment processing service holding a private key may decrypt them. The rest of the request must remain readable for normal application processing. Which CloudFront capability meets this requirement with the least change to backend components?

Accepted Answer

Enable CloudFront field-level encryption with a public key configuration so the specified sensitive fields are encrypted at the edge before forwarding to the origin.

Answer

Attach an AWS WAF web ACL to the distribution with a rule that masks the sensitive form fields before they reach the origin.

Answer

Require HTTPS between the viewer and CloudFront and between CloudFront and the origin using a custom ACM certificate to protect the fields in transit.

Answer

Use a CloudFront Function on the viewer request event to hash the sensitive fields with SHA-256 before they are forwarded to the ALB.