Can get my reports on Cloudfront sites to level A.
I think to get to A+ I need a way to solve this issue:
Any ideas on how to crack that one?
You don't need that for an A+. I suspect you've got a site hosted on S3 behind CloudFront, so you likely need a Lambda function to add the HSTS header. There are other security-related headers you can add, too.
Adding HTTP Security Headers Using Lambda@Edge and Amazon CloudFront | Networking & Content Delivery
Scoring A+ for Security Headers on My Cloudfront-Hosted Static Website - Adam Johnson
Retrieving data ...