AWS CloudFront web distribution with default SSL certificate misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_42
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	LOW
Framework	Terraform
Mapped CSPM/KSPM Rule	64519df3-368a-4329-a67a-4f2059f8eb5c

Impact

This rule identifies CloudFront web distributions which have a default SSL certificate to access CloudFront content. It is a best practice to use custom SSL Certificate to access CloudFront content. It gives you full control over the content data. custom SSL certificates also allow your users to access your content by using an alternate domain name. You can use a certificate stored in AWS Certificate Manager (ACM) or you can use a certificate stored in IAM.

How to Fix

[source,go]

resource "aws_cloudfront_distribution" "pass_1" {

origin { domain_name = aws_s3_bucket.primary.bucket_regional_domain_name origin_id = "primaryS3"

s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } }

default_cache_behavior { target_origin_id = "groupS3" }

viewer_certificate { acm_certificate_arn = "aaaaa" } }