CloudFront is supporting an insecure minimum protocol version

Severity: Low
Service: CloudFront
Check ID: CLOUDFRONT_MINIMUM_PROTOCOL_SUPPORT

What this check finds

An advanced attacker with a privileged position in a network could obtain access to the encrypted traffic coming to this CloudFront distribution because this distribution supports an older, weaker protocol version.

Passing looks like: CloudFront enforces a secure minimum TLS version.

How to fix it

Update the CloudFront distribution's security policy to TLSv1.2_2021. With the CLI, fetch the distribution config, set ViewerCertificate.MinimumProtocolVersion to TLSv1.2_2021 and submit it with update-distribution.

AWS console

CloudFront → Distributions → select distribution → Edit → Security policy → TLSv1.2_2021.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to CloudFront is supporting an insecure minimum protocol version
Framework	Controls
PCI-DSS v4.0.1	4.2 PAN is protected with strong cryptography during transmission over open, public networks
HIPAA Security Rule	164.312(e)(1) Implement technical security measures to guard against unauthorized access to ePHI in transit
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls
NIST SP 800-53 Rev5 (Moderate)	SC-8 Transmission Confidentiality and Integrity SC-23 Session Authenticity
NIST Cybersecurity Framework 2.0	PR.DS-02 Data-in-transit is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs