CloudFront Distributions Should Not Use Insecure SSL Protocols
More Info:
Your AWS Cloudfront Content Delivery Network distributions should not be using insecure SSL protocols (i.e. SSLv3) for HTTPS communication between CloudFront edge locations and your custom origins.Risk Level
MediumAddress
SecurityCompliance Standards
AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “CloudFront Distributions Should Not Use Insecure SSL Protocols” in AWS using AWS console, follow the below steps:
- Login to your AWS console.
- Go to the CloudFront service.
- Select the distribution which is using insecure SSL protocols.
- Click on the “Edit” button.
- Scroll down to the “SSL Certificate” section.
- In the “Minimum SSL Protocol Version” dropdown, select “TLSv1.2_2018”.
- Click on the “Yes, Edit” button to save the changes.
Using CLI
Using CLI
To remediate the CloudFront Distributions Should Not Use Insecure SSL Protocols misconfiguration in AWS using AWS CLI, you can follow the below steps:Note: Replace Note: Replace
- Open your terminal and install AWS CLI if it is not installed already.
- Run the following command to update the CloudFront distribution to use only secure SSL protocols:
<distribution-id> with the ID of the CloudFront distribution that you want to update.- After running the above command, the CloudFront distribution will be updated to use only secure SSL protocols.
- Verify the changes by checking the SSL protocols used by the CloudFront distribution using the following command:
<distribution-id> with the ID of the CloudFront distribution that you updated.- The output of the above command should show that the minimum SSL protocol version is TLSv1.1 or higher.
Using Python
Using Python
To remediate the misconfiguration of CloudFront distributions using insecure SSL protocols in AWS using Python, you can follow the below steps:
- Import the required AWS modules and libraries in your Python script:
- Create an AWS client for CloudFront using the boto3 library:
- Get a list of all the CloudFront distributions using the
list_distributionsmethod:
- Loop through the list of CloudFront distributions and check if they are using insecure SSL protocols. You can do this by checking the value of the
MinimumProtocolVersionparameter. If it is set toSSLv3orTLSv1, then it is using an insecure SSL protocol.
- To remediate the misconfiguration, you need to update the CloudFront distribution with a secure SSL protocol. You can do this by updating the
ViewerCertificateparameter with a new value forMinimumProtocolVersion. For example, to set it toTLSv1.2_2018, you can use theupdate_distributionmethod:
- Finally, run the Python script to remediate the misconfiguration for all the CloudFront distributions using insecure SSL protocols.