HIGH
Source
Trivy/CSPM
CSPM ID
insecure-cloudfront-protocols
ID
AVD-AWS-0013

CloudFront distribution uses outdated SSL/TLS protocols.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Note: that setting minimum_protocol_version = “TLSv1.2_2021” is only possible when cloudfront_default_certificate is false (eg. you are not using the cloudfront.net domain name). If cloudfront_default_certificate is true then the Cloudfront API will only allow setting minimum_protocol_version = “TLSv1”, and setting it to any other value will result in a perpetual diff in your terraform plan’s. The only option when using the cloudfront.net domain name is to ignore this rule.

Impact

Outdated SSL policies increase exposure to known vulnerabilities

Follow the appropriate remediation steps below to resolve the issue.

Use the most modern TLS/SSL policies available

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
Resources:
  GoodExample:
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          TargetOriginId: target
          ViewerProtocolPolicy: https-only
        Enabled: true
        Logging:
          Bucket: logging-bucket
        Origins:
          - DomainName: https://some.domain
            Id: somedomain1
        ViewerCertificate:
          MinimumProtocolVersion: TLSv1.2_2021
    Type: AWS::CloudFront::Distribution

  1. Log in to the AWS Management Console.

  2. Select the “Services” option and search for CloudFront. Step

  3. Select the “CloudFront Distribution” that needs to be verified.Step

  4. Click the “Distribution ID” of the selected Distribution to get into the “CloudFront Distribution” configuration page. Step

  5. In the “General” tab of top menu, scroll to settings and click on the “Edit” button. Step

  6. On the Edit Settings page, scroll down and choose the “Security Policy” that you want CloudFront to use for HTTPS connections and must use TLSv1.2 “recommended” or higher SSL protocols.Step

  7. Scroll down and click on “Save Changes” to save the settings.Step

  8. Repeat the steps number 3 to 6 to verify whether any other “CloudFront Distribution” is not using an insecure SSL protocol for HTTPS traffic.

Use the most modern TLS/SSL policies available

1
2
3
4
5
6
7
 resource "aws_cloudfront_distribution" "good_example" {
   viewer_certificate {
     cloudfront_default_certificate = false
     minimum_protocol_version = "TLSv1.2_2021"
   }
 }