> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudfront insecure ssl remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "CloudFront Distributions Should Not Use Insecure SSL Protocols" in AWS using AWS console, follow the below steps:

        1. Login to your AWS console.
        2. Go to the CloudFront service.
        3. Select the distribution which is using insecure SSL protocols.
        4. Click on the "Edit" button.
        5. Scroll down to the "SSL Certificate" section.
        6. In the "Minimum SSL Protocol Version" dropdown, select "TLSv1.2\_2018".
        7. Click on the "Yes, Edit" button to save the changes.

        By doing this, you have successfully remediated the misconfiguration "CloudFront Distributions Should Not Use Insecure SSL Protocols" in AWS using AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the CloudFront Distributions Should Not Use Insecure SSL Protocols misconfiguration in AWS using AWS CLI, you can follow the below steps:

        1. Open your terminal and install AWS CLI if it is not installed already.

        2. Run the following command to update the CloudFront distribution to use only secure SSL protocols:

        ```
        aws cloudfront update-distribution --id <distribution-id> --viewer-protocol-policy https-only
        ```

        Note: Replace `<distribution-id>` with the ID of the CloudFront distribution that you want to update.

        3. After running the above command, the CloudFront distribution will be updated to use only secure SSL protocols.

        4. Verify the changes by checking the SSL protocols used by the CloudFront distribution using the following command:

        ```
        aws cloudfront get-distribution-config --id <distribution-id> --query "DistributionConfig.ViewerCertificate.MinimumProtocolVersion"
        ```

        Note: Replace `<distribution-id>` with the ID of the CloudFront distribution that you updated.

        5. The output of the above command should show that the minimum SSL protocol version is TLSv1.1 or higher.

        By following these steps, you can remediate the CloudFront Distributions Should Not Use Insecure SSL Protocols misconfiguration in AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of CloudFront distributions using insecure SSL protocols in AWS using Python, you can follow the below steps:

        1. Import the required AWS modules and libraries in your Python script:

        ```
        import boto3
        from botocore.exceptions import ClientError
        ```

        2. Create an AWS client for CloudFront using the boto3 library:

        ```
        cloudfront_client = boto3.client('cloudfront')
        ```

        3. Get a list of all the CloudFront distributions using the `list_distributions` method:

        ```
        response = cloudfront_client.list_distributions()
        ```

        4. Loop through the list of CloudFront distributions and check if they are using insecure SSL protocols. You can do this by checking the value of the `MinimumProtocolVersion` parameter. If it is set to `SSLv3` or `TLSv1`, then it is using an insecure SSL protocol.

        ```
        for distribution in response['DistributionList']['Items']:
            if distribution['ViewerCertificate']['MinimumProtocolVersion'] in ['SSLv3', 'TLSv1']:
                # Remediation steps go here
        ```

        5. To remediate the misconfiguration, you need to update the CloudFront distribution with a secure SSL protocol. You can do this by updating the `ViewerCertificate` parameter with a new value for `MinimumProtocolVersion`. For example, to set it to `TLSv1.2_2018`, you can use the `update_distribution` method:

        ```
        distribution_id = distribution['Id']
        etag = distribution['ETag']
        viewer_certificate = {
            'CloudFrontDefaultCertificate': False,
            'MinimumProtocolVersion': 'TLSv1.2_2018'
        }
        try:
            cloudfront_client.update_distribution(
                DistributionConfig={
                    'ViewerCertificate': viewer_certificate
                },
                Id=distribution_id,
                IfMatch=etag
            )
            print(f"Successfully updated CloudFront distribution {distribution_id}")
        except ClientError as e:
            print(f"Error updating CloudFront distribution {distribution_id}: {e}")
        ```

        6. Finally, run the Python script to remediate the misconfiguration for all the CloudFront distributions using insecure SSL protocols.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_cloudfront_distribution" "CLOUDFRONT_DISTRIBUTION_NAME" {
          # Replace CLOUDFRONT_DISTRIBUTION_NAME with a suitable local name.
          enabled             = true
          default_root_object = "index.html"

          origin {
            domain_name = "CUSTOM_ORIGIN_DOMAIN_NAME" # e.g. myapp.example.com
            origin_id   = "CUSTOM_ORIGIN_ID"

            custom_origin_config {
              http_port              = 80
              https_port             = 443
              origin_protocol_policy = "https-only"

              # FIX: only allow secure TLS protocol(s) from CloudFront to the custom origin
              origin_ssl_protocols = [
                "TLSv1.2",
              ]
            }
          }

          default_cache_behavior {
            target_origin_id       = "CUSTOM_ORIGIN_ID"
            viewer_protocol_policy = "redirect-to-https"
            allowed_methods        = ["GET", "HEAD"]
            cached_methods         = ["GET", "HEAD"]

            forwarded_values {
              query_string = false

              cookies {
                forward = "none"
              }
            }
          }

          restrictions {
            geo_restriction {
              restriction_type = "none"
            }
          }

          viewer_certificate {
            acm_certificate_arn      = "ACM_CERTIFICATE_ARN"
            ssl_support_method       = "sni-only"
            minimum_protocol_version = "TLSv1.2_2021"
          }

          aliases = ["CLOUDFRONT_ALIAS_DOMAIN_NAME"] # e.g. cdn.example.com
        }
        ```

        This change updates the origin’s `origin_ssl_protocols` so CloudFront only uses TLSv1.2 when connecting to your custom origin; it is an in‑place update (no distribution replacement), but propagation can take several minutes globally.

        To verify, `terraform plan` should show the existing `aws_cloudfront_distribution` with a diff changing `custom_origin_config.origin_ssl_protocols` from the old list (including `SSLv3`/`TLSv1.0`/`TLSv1.1`) to only `["TLSv1.2"]`, with no `create`/`destroy` actions on the distribution itself.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>