Back to Checks
aws

CloudFront distribution does not use SSLv3, TLSv1, or TLSv1.1 for origin connections

cloudfront_distributions_using_deprecated_ssl_protocols
Service: cloudfrontSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCloudFrontDistribution

CloudFront distributions have origins whose OriginSslProtocols allow deprecated SSL/TLS versions (SSLv3, TLSv1, TLSv1.1) for CloudFront-to-origin HTTPS connections.

Prowler logoProwlerprowler-provider-aws

Risk

Weak protocols between CloudFront and the origin allow downgrades and known exploits (e.g., POODLE/BEAST), enabling eavesdropping or content tampering. This compromises the confidentiality and integrity of data in transit, exposing cookies, credentials, and responses served to viewers.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cloudfront_distributions_using_deprecated_ssl_protocols

Recommendation

Enforce TLS 1.2+ for CloudFront-to-origin traffic. Remove SSLv3, TLSv1, TLSv1.1 from allowed protocols and prefer modern cipher suites. Verify origin compatibility, update certificates and libraries, and periodically review policies as part of defense in depth and least privilege.

Remediation

CLI

aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to change Origins[].CustomOriginConfig.OriginSslProtocols to [TLSv1.2], then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Terraform

# Terraform: set origin to allow only TLSv1.2 when connecting to the origin
resource "aws_cloudfront_distribution" "<example_resource_name>" {
  enabled = true

  origin {
    domain_name = "<origin.example.com>"
    origin_id   = "<example_origin_id>"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]  # CRITICAL: restrict origin SSL protocols to TLSv1.2
    }
  }

  default_cache_behavior {
    target_origin_id       = "<example_origin_id>"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    forwarded_values { query_string = false }
  }
}

NativeIaC

# CloudFormation: set origin to allow only TLSv1.2 when connecting to the origin
Resources:
  <example_resource_name>:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - Id: <example_origin_id>
            DomainName: <origin.example.com>
            CustomOriginConfig:
              OriginProtocolPolicy: https-only
              OriginSslProtocols:
                - TLSv1.2  # CRITICAL: restrict origin SSL protocols to TLSv1.2 to remove SSLv3/TLSv1/TLSv1.1
        DefaultCacheBehavior:
          TargetOriginId: <example_origin_id>
          ViewerProtocolPolicy: redirect-to-https

Other

1Open the AWS Console and go to CloudFront
2Select the distribution and open the Origins tab
3Select the custom origin and click Edit
4Under Origin SSL protocols, select only TLSv1.2
5Save changes
6Repeat for any other custom origins in the distribution

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cloudfront.cloudfront_client import (
    cloudfront_client,
)
from prowler.providers.aws.services.cloudfront.cloudfront_service import (
    OriginsSSLProtocols,
)


class cloudfront_distributions_using_deprecated_ssl_protocols(Check):
    def execute(self):
        findings = []
        for distribution in cloudfront_client.distributions.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
            report.status = "PASS"
            report.status_extended = f"CloudFront Distribution {distribution.id} is not using a deprecated SSL protocol."

            bad_ssl_protocol = False
            for origin in distribution.origins:
                if origin.origin_ssl_protocols:
                    for ssl_protocol in origin.origin_ssl_protocols:
                        if ssl_protocol in (
                            OriginsSSLProtocols.SSLv3.value,
                            OriginsSSLProtocols.TLSv1.value,
                            OriginsSSLProtocols.TLSv1_1.value,
                        ):
                            bad_ssl_protocol = True
                            break

                if bad_ssl_protocol:
                    report.status = "FAIL"
                    report.status_extended = f"CloudFront Distribution {distribution.id} is using a deprecated SSL protocol."
                    break

            findings.append(report)

        return findings

References