Project: KICS (Provisioning / Security & Compliance)
File: 255b0fcc-9f82-41fe-9229-01b163e3376b.md

title: CloudFront Without Minimum Protocol TLS 1.2 hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 255b0fcc-9f82-41fe-9229-01b163e3376b Query name: CloudFront Without Minimum Protocol TLS 1.2 Platform: Crossplane Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: CloudFront Minimum Protocol version should be at least TLS 1.2<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="54 14" apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.1_2016 origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-cloudfront base: apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.1_2016 origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="8 44" apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-cloudfront base: apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="50 11" apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-cloudfront base: apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.2_2018 origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" apiVersion: apiextensions.crossplane.io/v1 kind: Composition metadata: name: cluster-aws labels: provider: aws cluster: eks spec: compositeTypeRef: apiVersion: mydev.org/v1alpha1 kind: CompositeCluster writeConnectionSecretsToNamespace: crossplane-system patchSets: name: metadata patches: fromFieldPath: metadata.labels resources: name: sample-cloudfront base: apiVersion: cloudfront.aws.crossplane.io/v1alpha1 kind: Distribution metadata: name: sample-distribution spec: forProvider: region: us-east-1 distributionConfig: enabled: true comment: Crossplane - auto provisioning viewerCertificate: sslSupportMethod: sni-only cloudFrontDefaultCertificate: false minimumProtocolVersion: TLSv1.2_2018 origins: items: domainName: sample.s3.amazonaws.com id: s3Origin s3OriginConfig: originAccessIDentity: "" ```