Amazon CloudFront announces Passthrough Mode for mutual TLS (Viewer)

Amazon CloudFront Passthrough Mode for mTLS Authentication

Amazon CloudFront now supports passthrough mode for viewer mutual TLS (mTLS) authentication, allowing clients to forward certificates to their origin for validation without CloudFront performing certificate verification. This mode is ideal for customers with existing mTLS implementations at their origins, enabling them to maintain their validation logic without configuring trust stores on CloudFront.

In passthrough mode, CloudFront forwards every request to the origin with the client's full certificate chain, ensuring end-to-end authentication by the origin. Caching is not performed, and connection functions are still invoked to process certificate data before it reaches the origin.

What to do

• Update your CloudFront distribution to use passthrough mode for mTLS authentication.
• Ensure your origin is configured to validate client certificates forwarded by CloudFront.
• Review the documentation for CloudFront Mutual TLS (Viewer) for more details.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.