---
description: How to add a Content Security Policy header with an AWS CloudFront response headers policy, and why the managed policy will not do it.
---

# AWS CloudFront

CloudFront can add a CSP header to responses without touching your origin, using a response headers policy attached to a cache behaviour. There is one trap worth knowing before you start.

## The managed policy does not include CSP

CloudFront ships managed response headers policies, and one of them is called `SecurityHeadersPolicy`. It is easy to attach it, tick "security headers" off the list, and move on.

It does not include a Content Security Policy. `SecurityHeadersPolicy` sets exactly five headers:

- `Referrer-Policy: strict-origin-when-cross-origin`
- `Strict-Transport-Security: max-age=31536000`
- `X-Content-Type-Options: nosniff`
- `X-Frame-Options: SAMEORIGIN`
- `X-XSS-Protection: 1; mode=block`

The same is true of `CORS-and-SecurityHeadersPolicy` and `CORS-with-preflight-and-SecurityHeadersPolicy`, which just combine that set with CORS headers. For a CSP you need a **custom** response headers policy.

## What a custom policy gives you

- A `Content-Security-Policy` header with the directives you specify.
- An override flag controlling whether CloudFront replaces a `Content-Security-Policy` header already sent by the origin, or defers to it.
- Attachment to one or more cache behaviours, so a policy can be scoped to a path pattern - your checkout, for example - rather than the whole distribution.
- Management through the console, CloudFormation, the CLI or the SDKs.

## Sending reports to Report URI

Create a custom response headers policy and put your reporting directive in the header value. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/wizard

That is the same starting policy we recommend for the [CSP Wizard](/setup/wizard/). Note that CloudFront's response headers policy has a dedicated field for `Content-Security-Policy` - to run a report-only rollout you will need to add `Content-Security-Policy-Report-Only` as a custom header instead.

## Things to watch for

- Decide deliberately whether to override the origin. Leaving override off when the origin also sends a policy means the browser gets two, and enforces the intersection of both.
- CloudFront caches responses along with their headers. After changing a policy, invalidate rather than waiting to see whether the new one is live.
- A response headers policy is static, so it cannot generate a per-request nonce. Nonce-based policies have to come from the application - see our [Frameworks](/frameworks/) guides.

## Official documentation

[AWS - Create response headers policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)