CloudFront does not use deprecated SSL/TLS protocols

Check ID: cloudfront_distributions_using_deprecated_ssl_protocols
Provider: AWS
Service: cloudfront
Severity: LOW
Categories: encryption
Resource type: AwsCloudFrontDistribution

What this check verifies

CloudFront distributions have origins whose OriginSslProtocols allow deprecated SSL/TLS versions (SSLv3, TLSv1, TLSv1.1) for CloudFront-to-origin HTTPS connections.

Risk

Weak protocols between CloudFront and the origin allow downgrades and known exploits (e.g., POODLE/BEAST), enabling eavesdropping or content tampering. This compromises the confidentiality and integrity of data in transit, exposing cookies, credentials, and responses served to viewers.

Recommendation

Enforce TLS 1.2+ for CloudFront-to-origin traffic. Remove SSLv3, TLSv1, TLSv1.1 from allowed protocols and prefer modern cipher suites. Verify origin compatibility, update certificates and libraries, and periodically review policies as part of defense in depth and least privilege.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —output json > current-config.json && echo ‘Manually edit current-config.json to change Origins[].CustomOriginConfig.OriginSslProtocols to [TLSv1.2], then run:’ && echo ‘aws cloudfront update-distribution —id <DISTRIBUTION_ID> —distribution-config file://current-config.json —if-match $(aws cloudfront get-distribution-config —id <DISTRIBUTION_ID> —query “ETag” —output text)’

# Terraform: set origin to allow only TLSv1.2 when connecting to the origin
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<origin.example.com>"
    origin_id   = "<example_origin_id>"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]  # CRITICAL: restrict origin SSL protocols to TLSv1.2
    }
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    forwarded_values { query_string = false }
  }
}

# CloudFormation: set origin to allow only TLSv1.2 when connecting to the origin
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: <example_origin_id>
            DomainName: <origin.example.com>
            CustomOriginConfig:
              OriginProtocolPolicy: https-only
              OriginSslProtocols:
                - TLSv1.2  # CRITICAL: restrict origin SSL protocols to TLSv1.2 to remove SSLv3/TLSv1/TLSv1.1
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: redirect-to-https

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_using_deprecated_ssl_protocols. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudFront S3 origins reference existing buckets CloudFront distribution uses an AWS WAF web ACL

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires