I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled however.
Presuming our content in our main website is forced to run over https and modern browsers won't allow http content to load when the main domain is https. None of our main content will ever run on http. What risks still exist?
My understanding is there wouldn't be any (unless there was some legacy browser in use).
Thanks in advance.