I am hosting a website on Amazon CloudFront and we've recently updated the distribution to require HTTPS between CloudFront and viewers. With the introduction of AWS Certificate Manager and the viability of SNI, this move is simple and cheap. The benefits of moving this to HTTPS are numerous.
I'm now wondering about the benefit of requiring HTTPS between CloudFront and my origin server (which is a custom origin). I know that would mean that CF would request all origin objects over HTTPS, but I'm struggling to find what benefit (security or otherwise) this provides. Is there a practical attack vector that could be exploited because requests to the origin are not made over HTTPS?
There is more administrative overhead to setting up and maintaining HTTPS on the origin server, so I want to know, do the benefits make that overhead worthwhile?