Use Secure Tls Policy | Vulnerability Database

CloudFront distribution uses outdated SSL/TLS protocols.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Note: that setting minimum_protocol_version = “TLSv1.2_2021” is only possible when cloudfront_default_certificate is false (eg. you are not using the cloudfront.net domain name). If cloudfront_default_certificate is true then the Cloudfront API will only allow setting minimum_protocol_version = “TLSv1”, and setting it to any other value will result in a perpetual diff in your terraform plan’s. The only option when using the cloudfront.net domain name is to ignore this rule.

Impact

Outdated SSL policies increase exposure to known vulnerabilities

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Use the most modern TLS/SSL policies available

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  GoodExample:
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          TargetOriginId: target
          ViewerProtocolPolicy: https-only
        Enabled: true
        Logging:
          Bucket: logging-bucket
        Origins:
          - DomainName: https://some.domain
            Id: somedomain1
        ViewerCertificate:
          MinimumProtocolVersion: TLSv1.2_2021
    Type: AWS::CloudFront::Distribution

Log into the AWS Management Console.
Select the “Services” option and search for CloudFront.
Select the “CloudFront Distribution” that needs to be verified.
Click the “Distribution Settings” button from menu to get into the “CloudFront Distribution” configuration page.
Click the “Edit” button from the General tab on the top menu.
Scroll down and choose the “Security Policy” that you want CloudFront to use for HTTPS connections and must use TLSv1.1 or higher SSL protocols.
Scroll down and click on “Yes,Edit” to save the changes.
Repeat the steps number 5 and 6 to establish any other “CloudFront Distribution” is not using an insecure SSL protocol for HTTPS traffic.

Use the most modern TLS/SSL policies available

1
2
3
4
5
6


resource "aws_cloudfront_distribution" "good_example" {
  viewer_certificate {
    cloudfront_default_certificate = true
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#minimum_protocol_version