Implementing HTTP Strict Transport Security (HSTS) across AWS services

This article provides a comprehensive guide to implementing HTTP Strict Transport Security (HSTS) across AWS services to protect against protocol downgrade attacks and cookie hijacking.

• HSTS enforces browser-level HTTPS-only connections, preventing SSL stripping attacks
• API Gateway: Configure via response parameter mapping (HTTP APIs) or mapping templates/method responses (REST APIs)
• Application Load Balancers: Use built-in response header modification feature for centralized HSTS enforcement
• CloudFront: Deploy HSTS via response headers policies with managed or custom configurations
• Start with shorter max-age values (300 seconds) and gradually increase to production levels (31,536,000 seconds)
• Include includeSubDomains directive for comprehensive subdomain protection
• Consider HSTS preloading for maximum security but understand irreversibility and long-term commitment

This unified approach enables consistent security policies across distributed AWS architectures while aligning with Well-Architected Framework principles.