HTTP to HTTPS Redirection for API Gateway: Why CloudFront Is Required

Why API Gateway doesn't serve HTTP

API Gateway regional endpoints only accept connections on port 443 (HTTPS). Port 80 is not open — there is no listener. A client connecting to http://api.example.com (port 80) receives ERR_CONNECTION_REFUSED because nothing answers on that port.

This is by design. API Gateway manages TLS termination at the edge and has no facility for plain HTTP traffic. The same is true for API Gateway's default execute-api URL and for custom domain endpoints.

The solution: CloudFront in front of API Gateway

Place a CloudFront distribution between the client and API Gateway. CloudFront handles port 80, issues the redirect, and forwards HTTPS traffic to API Gateway over port 443.

Client (HTTP port 80) → CloudFront → 301 redirect to HTTPS → client retries HTTPS
Client (HTTPS port 443) → CloudFront → forwards to API Gateway (HTTPS)

In Terraform:

resource "aws_cloudfront_distribution" "api" {
  origin {
    domain_name = aws_apigatewayv2_domain_name.api.domain_name_configuration[0].target_domain_name
    origin_id   = "api-gateway"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"  # CloudFront→API GW always HTTPS
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "api-gateway"
    viewer_protocol_policy = "redirect-to-https"  # HTTP clients get 301 to HTTPS

    allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods  = ["GET", "HEAD"]

    forwarded_values {
      query_string = true
      headers      = ["Authorization", "Origin", "Accept"]
      cookies {
        forward = "all"
      }
    }

    min_ttl     = 0
    default_ttl = 0    # Don't cache API responses by default
    max_ttl     = 0
  }

  aliases = ["api.example.com"]

  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate.api.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  enabled = true
}

viewer_protocol_policy = "redirect-to-https" is the key setting. CloudFront returns HTTP 301 to HTTPS for any HTTP request, then processes the HTTPS request normally.

The origin_protocol_policy = "https-only" ensures CloudFront never connects to API Gateway over HTTP — traffic is encrypted on both the client→CloudFront and CloudFront→API Gateway legs.

Route 53 configuration

Point your custom domain to the CloudFront distribution, not directly to API Gateway:

resource "aws_route53_record" "api" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "api.example.com"
  type    = "A"

  alias {
    name                   = aws_cloudfront_distribution.api.domain_name
    zone_id                = aws_cloudfront_distribution.api.hosted_zone_id
    evaluate_target_health = false
  }
}

With this setup, traffic flows: DNS → CloudFront → API Gateway. Clients connecting via HTTP get redirected before reaching API Gateway.

resource "aws_cloudfront_response_headers_policy" "security" {
  name = "api-security-headers"

  security_headers_config {
    strict_transport_security {
      access_control_max_age_sec = 31536000  # 1 year
      include_subdomains         = true
      preload                    = true
      override                   = true
    }
  }
}

default_cache_behavior {
  response_headers_policy_id = aws_cloudfront_response_headers_policy.security.id
  # ... other settings
}

Viewer Protocol Policy options

CloudFront's viewer_protocol_policy has three options:

• allow-all: accept both HTTP and HTTPS from clients. No redirect. Use only if you have a specific reason to accept HTTP.
• redirect-to-https: return HTTP 301 to HTTPS for HTTP requests. HTTPS requests pass through. The standard choice for public APIs.
• https-only: reject HTTP requests entirely (HTTP 403). No redirect. More strict than redirect — clients must already be using HTTPS.

For APIs, redirect-to-https is the standard. https-only is appropriate for internal APIs where you control all clients and can guarantee HTTPS usage.