Project: KICS (Provisioning / Security & Compliance)
File: 00e5e55e-c2ff-46b3-a757-a7a1cd802456.md

title: CloudFront Without Minimum Protocol TLS 1.2 hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 00e5e55e-c2ff-46b3-a757-a7a1cd802456 Query name: CloudFront Without Minimum Protocol TLS 1.2 Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: CloudFront Minimum Protocol version should be at least TLS 1.2<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awscloudfrontdistribution" "positive1" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { } restrictions { } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="25" resource "awscloudfrontdistribution" "positive2" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { } restrictions { } viewer_certificate { cloudfrontdefaultcertificate = false minimumprotocolversion = "TLSv1_2016" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="24" resource "awscloudfrontdistribution" "positive3" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { } restrictions { } viewer_certificate { cloudfrontdefaultcertificate = true } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="23" resource "awscloudfrontdistribution" "positive4" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { } restrictions { } viewer_certificate { cloudfrontdefaultcertificate = false } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awscloudfrontdistribution" "negative1" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { cloudfrontdefaultcertificate = false minimumprotocolversion = "TLSv1.2_2018" } } resource "awscloudfrontdistribution" "negative2" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true comment = "Some comment" defaultrootobject = "index.html" defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } viewer_certificate { cloudfrontdefaultcertificate = false minimumprotocolversion = "TLSv1.2_2019" } } ```