Implementing HTTP Strict Transport Security (HSTS) across AWS services

This post provides a comprehensive, step-by-step approach to implementing HTTP Strict Transport Security (HSTS) across Amazon API Gateway, Application Load Balancer, and Amazon CloudFront to create a unified, browser-enforced HTTPS policy and mitigate protocol downgrade and man-in-the-middle risks. It covers configuration methods for each service (including header mapping, ALB response header modification, and CloudFront response headers policies), validation via curl, and security best practices such as appropriate max-age selection, includeSubDomains, and preload considerations, aligning with AWS Well-Architected security principles.