Skip to content
FixSecurityHeadersScan a site

How to add Permissions-Policy on AWS CloudFront

Last updated · Reviewed by a CISSP-certified security practitioner

To add Permissions-Policy on AWS CloudFront, set the header in Response headers policy with the value camera=(), microphone=(), geolocation=(), payment=(), usb…. Turns off browser features (camera, mic, geolocation) you don't use. Attach the policy to the distribution's cache behavior and wait for deployment. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Permissions-Policy do?

Permissions-Policy disables powerful browser APIs for your page and any embedded iframes unless you explicitly allow them.

Risk if missing: Injected or third‑party scripts could request camera, microphone, geolocation or payment APIs.

What is the AWS CloudFront configuration?

Add this to Response headers policy:

Response headers policy
// aws cloudfront create-response-headers-policy --response-headers-policy-config file://policy.json
{
  "Name": "fixsecurityheaders-policy",
  "SecurityHeadersConfig": {},
  "CustomHeadersConfig": {
    "Quantity": 1,
    "Items": [
      {
        "Header": "Permissions-Policy",
        "Value": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()",
        "Override": true
      }
    ]
  }
}

How do I add it step by step?

  1. Open Response headers policy.
  2. Paste the Permissions-Policy configuration shown below.
  3. Attach the policy to the distribution's cache behavior and wait for deployment.
  4. Run curl -I https://yourdomain.com and look for the permissions-policy line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "permissions-policy"
# expected:
# permissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.
  • AWS provides a managed SecurityHeadersPolicy, but a custom policy lets you set CSP.
  • Enable Override so origin headers don't win.

Quick reference

HeaderPermissions-Policy
Recommended valuecamera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()
StackAWS CloudFront
WhereResponse headers policy
ComplianceOWASP ASVS V14.4, SOC 2 CC6.8

FAQ

What value should I use for Permissions-Policy?

A safe default is camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(). Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.

Why isn't Permissions-Policy showing up on AWS CloudFront?

AWS provides a managed SecurityHeadersPolicy, but a custom policy lets you set CSP. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Permissions-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Permissions-Policy?

OWASP ASVS V14.4, SOC 2 CC6.8.

Related guides