Project: KICS (Provisioning / Security & Compliance)
File: dc17ee4b-ddf2-4e23-96e8-7a36abad1303.md

title: CloudFront Without Minimum Protocol TLS 1.2 hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: dc17ee4b-ddf2-4e23-96e8-7a36abad1303 Query name: CloudFront Without Minimum Protocol TLS 1.2 Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: CloudFront Minimum Protocol version should be at least TLS 1.2<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="25 33" AWSTemplateFormatVersion: 2010-09-09 Resources: cloudfrontdistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value DefaultCacheBehavior: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value IPV6Enabled: boolean-value Origins: CustomOriginConfig: OriginKeepaliveTimeout: integer-value OriginReadTimeout: integer-value ViewerCertificate: AcmCertificateArn: String CloudFrontDefaultCertificate: true IamCertificateId: String MinimumProtocolVersion: "TLSv1.1_2016" SslSupportMethod: String Tags: Key: string-value Value: string-value cloudfrontdistribution2: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value DefaultCacheBehavior: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value IPV6Enabled: boolean-value Origins: CustomOriginConfig: OriginKeepaliveTimeout: integer-value OriginReadTimeout: integer-value Tags: Key: string-value Value: string-value ``` ```json title="Positive test num. 2 - json file" hl_lines="11 55" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "cloudfrontdistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Enabled": true, "ViewerCertificate": { "IamCertificateId": "String", "MinimumProtocolVersion": "TLSv1.1_2016", "SslSupportMethod": "String", "AcmCertificateArn": "String", "CloudFrontDefaultCertificate": true }, "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] } ], "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] }, "IPV6Enabled": "boolean-value", "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": "integer-value", "OriginReadTimeout": "integer-value" } } ] }, "Tags": [ { "Key": "string-value", "Value": "string-value" } ] } }, "cloudfrontdistribution2": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "Enabled": true, "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": "integer-value", "OriginReadTimeout": "integer-value" } } ], "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] } ], "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "LambdaFunctionARN": "string-value", "EventType": "string-value" } ] }, "IPV6Enabled": "boolean-value" }, "Tags": [ { "Key": "string-value", "Value": "string-value" } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: cloudfrontdistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: CacheBehaviors: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value DefaultCacheBehavior: LambdaFunctionAssociations: EventType: string-value LambdaFunctionARN: string-value IPV6Enabled: boolean-value Origins: CustomOriginConfig: OriginKeepaliveTimeout: integer-value OriginReadTimeout: integer-value ViewerCertificate: AcmCertificateArn: String CloudFrontDefaultCertificate: true IamCertificateId: String MinimumProtocolVersion: "TLSv1.2_2018" SslSupportMethod: String Tags: Key: string-value Value: string-value ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "cloudfrontdistribution": { "Type": "AWS::CloudFront::Distribution", "Properties": { "DistributionConfig": { "CacheBehaviors": [ { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] } ], "DefaultCacheBehavior": { "LambdaFunctionAssociations": [ { "EventType": "string-value", "LambdaFunctionARN": "string-value" } ] }, "IPV6Enabled": "boolean-value", "Origins": [ { "CustomOriginConfig": { "OriginKeepaliveTimeout": "integer-value", "OriginReadTimeout": "integer-value" } } ], "ViewerCertificate": { "IamCertificateId": "String", "MinimumProtocolVersion": "TLSv1.2_2018", "SslSupportMethod": "String", "AcmCertificateArn": "String", "CloudFrontDefaultCertificate": true } }, "Tags": [ { "Key": "string-value", "Value": "string-value" } ] } } } } ```