JA EN
shiichan

CloudFront Now Forwards Viewer ISP and Post-Quantum TLS Details to Your Origin

AWS What's New ★★★★ View Markdown
#aws#security#web

Hi everyone, it's Shii-chan! CloudFront shows you more now, so let me introduce it!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced that Amazon CloudFront can forward two new optional headers to your origin.

  • CloudFront-Viewer-ISP: the name of the viewer's internet service provider (ISP), so you can see which network a request came from
  • CloudFront-Viewer-TLS-Details: the cryptography used on each viewer's TLS connection, so you can see whether it used post-quantum cryptography (PQC)

What changes

With CloudFront-Viewer-ISP, you can break down traffic and performance by network, and isolate unusual traffic from a single provider.

CloudFront-Viewer-TLS-Details includes the key exchange, signature scheme and signature public key type for each connection. You can measure the share of viewers who actually connect with PQC and identify clients that don't yet.

Dive Deep

Here's how to set it up:

  • Add the header you want to an origin request policy
  • Attach the policy to your distribution

See "adding CloudFront headers" and "controlling origin requests with a policy" in the CloudFront Developer Guide.

Wrap-up

  • CloudFront-Viewer-ISP enables per-ISP traffic analysis
  • CloudFront-Viewer-TLS-Details lets you measure PQC adoption
  • Just add them to an origin request policy

A good fit for CDN operators and security teams tracking the move to post-quantum cryptography!

Related posts