Skip to main content

CloudFront Distributions Should Use Security Policies With

More Info:​

Your Amazon CloudFront distributions should use a security policy with minimum TLSv1.2 and appropriate security ciphers for HTTPS viewer connections.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the CloudFront Distribution Security Policy misconfiguration in AWS, you can follow the below steps:

  1. Log in to your AWS Management Console.
  2. Navigate to the Amazon CloudFront service.
  3. Click on the "Distributions" tab from the left-hand menu.
  4. Select the CloudFront distribution that needs to be remediated.
  5. Click on the "Edit" button.
  6. Scroll down to the "Security Policy" section.
  7. Select the appropriate security policy version from the dropdown list. The recommended version is TLSv1.2_2018.
  8. Select the appropriate ciphers from the "Cipher Suites" dropdown list. The recommended ciphers are AES128-SHA256 and AES256-SHA256.
  9. Click on the "Yes, Edit" button to save the changes.

Once the changes are saved, the CloudFront distribution will use the appropriate security policies with the recommended version and ciphers.

Using CLI

To remediate this misconfiguration in AWS, you can follow the below steps using AWS CLI:

  1. First, you need to create a security policy with appropriate version and ciphers that you want to use for your CloudFront distribution. You can use the following command to create a security policy:
aws cloudfront create-public-key --name <policy-name> --public-key-config '{"CallerReference": "<unique-id>", "Name": "<policy-name>", "PublicKey": "<public-key>", "Comment": "<comment>"}'

Here, <policy-name> is the name you want to give to your security policy, <unique-id> is a unique identifier for the policy, <public-key> is the actual public key that you want to use, and <comment> is an optional comment that you can add.

  1. Once you have created your security policy, you need to update your CloudFront distribution to use this policy. You can use the following command to update your distribution:
aws cloudfront update-distribution --id <distribution-id> --distribution-config '{"ViewerCertificate": {"MinimumProtocolVersion": "<minimum-protocol-version>", "SSLSupportMethod": "<ssl-support-method>", "Certificate": "<certificate-arn>", "CertificateSource": "<certificate-source>", "SecurityPolicy": "<policy-name>"}}'

Here, <distribution-id> is the ID of your CloudFront distribution, <minimum-protocol-version> is the minimum TLS version that you want to use, <ssl-support-method> is the SSL support method that you want to use, <certificate-arn> is the ARN of the SSL certificate that you want to use, <certificate-source> is the source of the SSL certificate (either iam or acm), and <policy-name> is the name of the security policy that you created in step 1.

  1. Finally, you should verify that your CloudFront distribution is now using the correct security policy. You can use the following command to get the details of your distribution:
aws cloudfront get-distribution --id <distribution-id>

Here, <distribution-id> is the ID of your CloudFront distribution. This command will return the details of your distribution, including the security policy that it is currently using.

That's it! By following these steps, you can remediate the misconfiguration of using inappropriate security policies with appropriate version and ciphers for your AWS CloudFront distributions using AWS CLI.

Using Python

To remediate the misconfiguration "CloudFront Distributions Should Use Security Policies With Appropriate Version And Ciphers" for AWS using python, follow the below steps:

  1. Create a new security policy with appropriate version and ciphers using the AWS CLI command:
aws cloudfront create-security-policy --name <policy-name> --policy-config file://<policy-config-file>

Replace <policy-name> with the name you want to give to the new security policy and <policy-config-file> with the path to the JSON file containing the policy configuration.

  1. Update the CloudFront distribution to use the new security policy using the AWS CLI command:
aws cloudfront update-distribution --id <distribution-id> --distribution-config file://<distribution-config-file>

Replace <distribution-id> with the ID of the CloudFront distribution you want to update and <distribution-config-file> with the path to the JSON file containing the distribution configuration.

  1. Verify that the updated distribution is now using the new security policy with appropriate version and ciphers.

Note: You can also use the AWS SDK for Python (Boto3) to perform the above steps programmatically.

Using Terraform
resource "aws_cloudfront_distribution" "EXISTING_DISTRIBUTION" {
  # Replace with your existing distribution arguments
  enabled             = true
  default_root_object = "index.html"

  origin {
    domain_name = "YOUR_ORIGIN_DOMAIN_NAME"
    origin_id   = "YOUR_ORIGIN_ID"
  }

  default_cache_behavior {
    target_origin_id       = "YOUR_ORIGIN_ID"
    viewer_protocol_policy = "redirect-to-https"

    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
  }

  # This is the part that remediates the finding:
  viewer_certificate {
    # Use the certificate type you already have configured:
    # one of:
    #   acm_certificate_arn         = "YOUR_ACM_CERT_ARN"
    #   iam_certificate_id          = "YOUR_IAM_CERT_ID"
    #   cloudfront_default_certificate = true

    acm_certificate_arn            = "YOUR_ACM_CERT_ARN" # substitute your ACM cert ARN
    ssl_support_method             = "sni-only"
    minimum_protocol_version       = "TLSv1.2_2021"
    security_policy                = "TLSv1.2_2021"
  }

  # ...any other existing configuration (aliases, logging, restrictions, etc.)
}

Changing minimum_protocol_version / security_policy updates the distribution in place and does not force replacement, but may drop older TLS clients that can’t use TLS 1.2.

For verification, terraform plan should show an in‑place update on aws_cloudfront_distribution.EXISTING_DISTRIBUTION with viewer_certificate.minimum_protocol_version and/or viewer_certificate.security_policy changing to TLSv1.2_2021.

Additional Reading:​