You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.
Note: that setting minimum_protocol_version = “TLSv1.2_2021” is only possible when cloudfront_default_certificate is false (eg. you are not using the cloudfront.net domain name). If cloudfront_default_certificate is true then the Cloudfront API will only allow setting minimum_protocol_version = “TLSv1”, and setting it to any other value will result in a perpetual diff in your terraform plan’s. The only option when using the cloudfront.net domain name is to ignore this rule.
Outdated SSL policies increase exposure to known vulnerabilities
Follow the appropriate remediation steps below to resolve the issue.
Use the most modern TLS/SSL policies available
|
|