AWS CloudFront web distribution using insecure TLS version misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_174
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	3eb5afe3-259d-48d0-8437-ec58668be0d3

Impact

This rule identifies AWS CloudFront web distributions which are configured with TLS versions for HTTPS communication between viewers and CloudFront. As a best practice, use recommended TLSv1.2_2021 as the minimum protocol version in your CloudFront distribution security policies.

How to Fix

To fix this issue, ensure that the MinimumProtocolVersion property in the ViewerCertificate configuration of the AWS::CloudFront::Distribution resource is set to one of the approved TLS v1.2 versions (TLSv1.2_2018, TLSv1.2_2019, or TLSv1.2_2021).

Example: [source,go]

Resources: MyCloudFrontDistribution: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: ViewerCertificate: MinimumProtocolVersion: TLSv1.2_2021 ... ...