Amazon CloudFront now provides viewer ISP and post-quantum TLS details
Amazon CloudFront now forwards two optional headers to your origin. The CloudFront-Viewer-ISP header shows the viewer's ISP, and the CloudFront-Viewer-TLS-Details header shows whether post-quantum cryptography was used for each connection.
Amazon CloudFront can optionally forward two new headers to the origin. The CloudFront-Viewer-ISP header indicates the requesting internet service provider's name, helping identify the network origin. The CloudFront-Viewer-TLS-Details header describes the encryption method used for each viewer's TLS connection, including whether post-quantum cryptography (PQC) was applied. Using CloudFront-Viewer-ISP allows analysis of traffic and performance per network, and isolation of anomalous traffic from specific providers. CloudFront-Viewer-TLS-Details includes key exchange, signature scheme, and signature public key type for each connection, enabling measurement of the proportion of viewers using PQC and identification of unsupported clients. To forward either header to the origin, add it to an origin request policy and attach it to the distribution.
Why it matters
This update is relevant for developers and security professionals who need to analyze web traffic or enhance security. It allows detailed monitoring of request origins and encryption technologies using CloudFront features.