Project: KICS (Provisioning / Security & Compliance)
File: 3a1e94df-6847-4c0e-a3b6-6c6af4e128ef.md

title: Vulnerable Default SSL Certificate hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 3a1e94df-6847-4c0e-a3b6-6c6af4e128ef Query name: Vulnerable Default SSL Certificate Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Defaults URL: CloudFront web distributions should use custom (and not default) SSL certificates. Custom SSL certificates allow only defined users to access content by using an alternate domain name instead of the default one.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="88 5 134" resource "awss3bucket" "positive1" { } resource "awscloudfrontdistribution" "positive2" { origin { domainname = awss3bucket.positive1.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } } resource "awscloudfrontdistribution" "positive3" { origin { domainname = awss3bucket.positive1.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { cloudfrontdefaultcertificate = true } } resource "awscloudfrontdistribution" "positive4" { origin { domainname = awss3bucket.positive1.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { acmcertificatearn = awsacmcertificatevalidation.cert.certificatearn } } ``` ```tf title="Negative test num. 1 - tf file" resource "awss3bucket" "negative1" { } resource "awscloudfrontdistribution" "negative2" { origin { domainname = awss3bucket.negative1.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { acmcertificatearn = awsacmcertificatevalidation.cert.certificatearn sslsupportmethod = "sni-only" minimumprotocolversion = "TLSv1.2_2018" } } ```