AWS Introduction
AWS Pricing
AWS Threats
AWS Misconfigurations
- Getting Started with AWS Audit
- Permissions required for Misconfigurations Detection
- API Gateway Audit
- Cloudformation Audit
- CloudFront Audit
- CloudTrail Audit
- Cloudwatch Audit
- DynamoDB Audit
- EC2 Audit
- Elastic Search Audit
- ELB Audit
- IAM Audit
- KMS Audit
- Kubernetes Audit
- Lambda Audit
- RDS Audit
- Redshift Audit
- Route53 Audit
- S3 Audit
- Security Groups Audit
- SES Audit
- SNS Audit
- IAM Deep Dive
- App Sync Audit
- Code Build Audit
- Open Search Audit
- Shield Audit
- SQS Audit
CloudFront Distributions Should Use Security Policies With Appropriate Version And Ciphers
More Info:
Your Amazon CloudFront distributions should use a security policy with minimum TLSv1.2 and appropriate security ciphers for HTTPS viewer connections.
Risk Level
Medium
Address
Security
Compliance Standards
NISTCSF
Triage and Remediation
Remediation
To remediate the CloudFront Distribution Security Policy misconfiguration in AWS, you can follow the below steps:
- Log in to your AWS Management Console.
- Navigate to the Amazon CloudFront service.
- Click on the “Distributions” tab from the left-hand menu.
- Select the CloudFront distribution that needs to be remediated.
- Click on the “Edit” button.
- Scroll down to the “Security Policy” section.
- Select the appropriate security policy version from the dropdown list. The recommended version is TLSv1.2_2018.
- Select the appropriate ciphers from the “Cipher Suites” dropdown list. The recommended ciphers are AES128-SHA256 and AES256-SHA256.
- Click on the “Yes, Edit” button to save the changes.
Once the changes are saved, the CloudFront distribution will use the appropriate security policies with the recommended version and ciphers.
To remediate this misconfiguration in AWS, you can follow the below steps using AWS CLI:
- First, you need to create a security policy with appropriate version and ciphers that you want to use for your CloudFront distribution. You can use the following command to create a security policy:
aws cloudfront create-public-key --name <policy-name> --public-key-config '{"CallerReference": "<unique-id>", "Name": "<policy-name>", "PublicKey": "<public-key>", "Comment": "<comment>"}'
Here, <policy-name> is the name you want to give to your security policy, <unique-id> is a unique identifier for the policy, <public-key> is the actual public key that you want to use, and <comment> is an optional comment that you can add.
- Once you have created your security policy, you need to update your CloudFront distribution to use this policy. You can use the following command to update your distribution:
aws cloudfront update-distribution --id <distribution-id> --distribution-config '{"ViewerCertificate": {"MinimumProtocolVersion": "<minimum-protocol-version>", "SSLSupportMethod": "<ssl-support-method>", "Certificate": "<certificate-arn>", "CertificateSource": "<certificate-source>", "SecurityPolicy": "<policy-name>"}}'
Here, <distribution-id> is the ID of your CloudFront distribution, <minimum-protocol-version> is the minimum TLS version that you want to use, <ssl-support-method> is the SSL support method that you want to use, <certificate-arn> is the ARN of the SSL certificate that you want to use, <certificate-source> is the source of the SSL certificate (either iam or acm), and <policy-name> is the name of the security policy that you created in step 1.
- Finally, you should verify that your CloudFront distribution is now using the correct security policy. You can use the following command to get the details of your distribution:
aws cloudfront get-distribution --id <distribution-id>
Here, <distribution-id> is the ID of your CloudFront distribution. This command will return the details of your distribution, including the security policy that it is currently using.
That’s it! By following these steps, you can remediate the misconfiguration of using inappropriate security policies with appropriate version and ciphers for your AWS CloudFront distributions using AWS CLI.
To remediate the misconfiguration “CloudFront Distributions Should Use Security Policies With Appropriate Version And Ciphers” for AWS using python, follow the below steps:
- Create a new security policy with appropriate version and ciphers using the AWS CLI command:
aws cloudfront create-security-policy --name <policy-name> --policy-config file://<policy-config-file>
Replace <policy-name> with the name you want to give to the new security policy and <policy-config-file> with the path to the JSON file containing the policy configuration.
- Update the CloudFront distribution to use the new security policy using the AWS CLI command:
aws cloudfront update-distribution --id <distribution-id> --distribution-config file://<distribution-config-file>
Replace <distribution-id> with the ID of the CloudFront distribution you want to update and <distribution-config-file> with the path to the JSON file containing the distribution configuration.
- Verify that the updated distribution is now using the new security policy with appropriate version and ciphers.
Note: You can also use the AWS SDK for Python (Boto3) to perform the above steps programmatically.