Project: KICS (Provisioning / Security & Compliance)
File: b4d9c12b-bfba-4aeb-9cb8-2358546d8041.md

title: Vulnerable Default SSL Certificate hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b4d9c12b-bfba-4aeb-9cb8-2358546d8041 Query name: Vulnerable Default SSL Certificate Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Defaults URL: CloudFront web distributions should use custom (and not default) SSL certificates. Custom SSL certificates allow only defined users to access content by using an alternate domain name instead of the default one.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: 2010-09-09 Resources: myDistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: ViewerCertificate: AcmCertificateArn: arn:aws:autoscaling:us-west-2:123456789012:autoScalingGroup:a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="8" AWSTemplateFormatVersion: 2010-09-09 Resources: myDistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: ViewerCertificate: CloudfrontDefaultCertificate: true ``` ```json title="Positive test num. 3 - json file" hl_lines="8" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myDistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "ViewerCertificate": { "AcmCertificateArn": "arn:aws:autoscaling:us-west-2:123456789012:autoScalingGroup:a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" } } } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="9" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myDistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "ViewerCertificate": { "CloudfrontDefaultCertificate": "true" } } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Resources: myDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: ViewerCertificate: AcmCertificateArn: arn:aws:autoscaling:us-west-2:123456789012:autoScalingGroup:a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 MinimumProtocolVersion: TLS1.2_2019 SslSupportMethod: sni_only ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myDistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "ViewerCertificate": { "AcmCertificateArn": "some arn", "MinimumProtocolVersion": "TLS1.2_2019", "SslSupportMethod": "sni_only" } } } } } } ``` ```yaml title="Negative test num. 3 - yaml file" AWSTemplateFormatVersion: '2010-09-09' Resources: myDistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myDistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Enabled": "true" } } } } } ``` </details>