Why won't my content security policy deploy to CloudFront?

Question

I'm composing a fairly large CSP and deploying it to CloudFront with CloudFormation. The old CSP worked, but the new one doesn't. It doesn't look like it has any syntax errors.

Resource:

AWS::CloudFront::ResponseHeadersPolicy
 - ResponseHeadersPolicyConfig
  - SecurityHeadersConfig
   - ContentSecurityPolicy

The error is:

UPDATE_FAILED - Internal error reported from downstream service during operation 'AWS::CloudFront::ResponseHeadersPolicy'

Answer 1

The policy is too long

I'm pretty sure this was due to the CSP simply being too long. I can't find anything in the docs (neither W3C nor AWS) that say there's a limit to the length. But it seems that CloudFront won't accept a CSP longer than 1780 characters. Since I'm using the upgrade-insecure-requests directive, I don't really need to specify the scheme for the sources. So, changing the sources like this fixed the problem:

- default-src https://foo.example
+ default-src foo.example