Description
The CloudFront TLS security policy determines the minimum protocol version and cipher suites allowed for client connections. With a custom certificate, select the policy using viewer_certificate.minimum_protocol_version.
Potential impact
Allowing outdated SSL/TLS protocols can expose connections to known weaknesses or weak encryption.
Remediation
Configure a custom certificate with ssl_support_method = "sni-only" and choose a policy requiring TLS 1.2 or later. Switching to the default certificate alone does not enforce TLS 1.2 or later.
Examples
The examples show only the certificate settings. The revised example applies a policy requiring TLS 1.2 to the same custom certificate. The referenced ACM certificate must be in us-east-1.
Before
hcl
resource "aws_cloudfront_distribution" "example" {
viewer_certificate {
cloudfront_default_certificate = false
acm_certificate_arn = aws_acm_certificate.example.arn
ssl_support_method = "vip"
minimum_protocol_version = "SSLv3"
}
}
After
hcl
resource "aws_cloudfront_distribution" "example" {
viewer_certificate {
cloudfront_default_certificate = false
acm_certificate_arn = aws_acm_certificate.example.arn
ssl_support_method = "sni-only"
minimum_protocol_version = "TLSv1.2_2021"
}
}