Question

A security team operates a public web application served through Amazon CloudFront with an Application Load Balancer origin. A recent penetration test flagged that the application does not enforce HTTP Strict Transport Security (HSTS) and is missing X-Content-Type-Options and X-Frame-Options headers on responses. The development team is busy and cannot modify the application code for several sprints. The team needs a way to consistently add these security headers to all responses at the edge with minimal operational effort. Which approach best meets this requirement?

Accepted Answer

Attach a CloudFront response headers policy that includes the security headers configuration to the distribution's cache behavior.

Answer

Deploy an AWS WAF web ACL with a custom rule that injects the security headers into every HTTP response.

Answer

Configure the Application Load Balancer listener rules to add the security response headers before returning traffic to CloudFront.

Answer

Enable AWS Shield Advanced on the distribution and turn on the automatic security header enforcement feature.