Back to Checks
aws

CloudFront distributions enforce a post-quantum TLS 1.3 security policy

cloudfront_distributions_pqc_tls_enabled
Service: cloudfrontSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCloudFrontDistribution

CloudFront distributions are assessed for use of a TLS 1.3-only security policy (TLSv1.3_2025). CloudFront's quantum-safe key exchanges (X25519MLKEM768, SecP256r1MLKEM768) only work with TLS 1.3. Distributions that allow TLS 1.2 (or older) fallback to classical key exchanges and are exposed to harvest-now, decrypt-later attacks.

Prowler logoProwlerprowler-provider-aws

Risk

Without a TLS 1.3-only policy, viewer traffic captured today can be decrypted once a cryptographically relevant quantum computer is available. Distributions using the default CloudFront certificate (*.cloudfront.net) cannot enable a post-quantum policy because they are pinned to the legacy TLSv1 policy.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_pqc_tls_enabled

Recommendation

Use a custom SSL certificate with SNI support and set MinimumProtocolVersion to TLSv1.3_2025 so CloudFront refuses TLS 1.2 handshakes and uses the hybrid ML-KEM key exchange. Distributions still using the default CloudFront certificate must be migrated to a custom certificate to enable post-quantum TLS.

Remediation

CLI

aws cloudfront update-distribution --id <distribution_id> --distribution-config '{..."ViewerCertificate":{"MinimumProtocolVersion":"TLSv1.3_2025",...}}'

Terraform

resource "aws_cloudfront_distribution" "<example_resource_name>" {
  # ...
  viewer_certificate {
    acm_certificate_arn      = "<example_certificate_arn>"
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.3_2025" # FIX: enforces TLS 1.3 + post-quantum KEX
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        ViewerCertificate:
          AcmCertificateArn: <example_certificate_arn>
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.3_2025  # FIX: enforces TLS 1.3 + post-quantum KEX

Other

1In the AWS Console, go to CloudFront > Distributions
2Select the distribution and open the General tab
3Choose Edit on Settings
4Set Custom SSL certificate (do not use the default *.cloudfront.net certificate)
5Set Security policy to TLSv1.3_2025
6Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)

PQC_CLOUDFRONT_POLICIES_DEFAULT = [
    "TLSv1.3_2025",
]


class cloudfront_distributions_pqc_tls_enabled(Check):
    """Verify that every CloudFront distribution enforces TLS 1.3 with post-quantum key exchange.

    Quantum-safe key exchanges (``X25519MLKEM768``, ``SecP256r1MLKEM768``) are
    only available on TLS 1.3 viewer connections. A distribution PASSES when
    its ``MinimumProtocolVersion`` belongs to the configured allowlist of
    TLS 1.3-only policies. Distributions that rely on the default CloudFront
    certificate are pinned to the legacy ``TLSv1`` policy and therefore FAIL.
    """

    def execute(self) -> list[Check_Report_AWS]:
        """Execute the CloudFront post-quantum TLS policy check.

        Returns:
            A list of reports containing each CloudFront distribution's
            post-quantum TLS compliance status.
        """
        findings = []
        pqc_policies = cloudfront_client.audit_config.get(
            "cloudfront_pqc_min_protocol_versions", PQC_CLOUDFRONT_POLICIES_DEFAULT
        )
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
            policy = distribution.minimum_protocol_version or "<none>"
            if distribution.default_certificate:
                report.status = "FAIL"
                report.status_extended = (
                    f"CloudFront Distribution {distribution.id} uses the default "
                    "CloudFront certificate, which pins the security policy to "
                    "TLSv1 and cannot enable post-quantum TLS."
                )
            elif distribution.minimum_protocol_version in pqc_policies:
                report.status = "PASS"
                report.status_extended = (
                    f"CloudFront Distribution {distribution.id} uses post-quantum "
                    f"TLS policy {policy}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"CloudFront Distribution {distribution.id} uses TLS policy "
                    f"{policy}, which is not in the post-quantum allowlist."
                )
            findings.append(report)

        return findings

References