For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/ansible-aws-vulnerable-default-ssl-certificate.md.
A documentation index is available at /llms.txt.
CloudFront distributions should use custom SSL certificates rather than the default CloudFront certificate. Custom certificates enable serving content on custom domain names and enforce strong, managed TLS settings for data in transit.
For Ansible tasks using community.aws.cloudfront_distribution or cloudfront_distribution, the viewer_certificate.cloudfront_default_certificate property must be false or not defined. If viewer_certificate.acm_certificate_arn or viewer_certificate.iam_certificate_id is provided, then viewer_certificate.ssl_support_method and viewer_certificate.minimum_protocol_version must also be defined.
Resources with cloudfront_default_certificate set to true, or with a custom certificate but missing ssl_support_method or minimum_protocol_version, are flagged. Use a secure viewer_certificate block that references a custom ACM or IAM certificate and explicitly sets the SSL support method and a modern minimum protocol version.
Secure example for an Ansible CloudFront distribution:
- name:Create CloudFront distribution with custom certificatecommunity.aws.cloudfront_distribution:name:my-distributionviewer_certificate:acm_certificate_arn:arn:aws:acm:us-east-1:123456789012:certificate/abcd-ef01-2345ssl_support_method:sni-onlyminimum_protocol_version:TLSv1.2_2019
Compliant Code Examples
- name:create a basic distribution with defaults, tags and custom SSL certificatecommunity.aws.cloudfront_distribution:state:presentcaller_reference:my-distribution-ssl-negativedefault_origin_domain_name:www.my-cloudfront-origin.comviewer_certificate:acm_certificate_arn:arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012ssl_support_method:sni-onlyminimum_protocol_version:TLS1.2_2018tags:Name:example distributionProject:example projectPriority:'1'
Non-Compliant Code Examples
- name:create a basic distribution with defaults, tags and default SSL certificatecommunity.aws.cloudfront_distribution:state:presentcaller_reference:my-distribution-ssl-defaultdefault_origin_domain_name:www.my-cloudfront-origin.comviewer_certificate:cloudfront_default_certificate:truetags:Name:example distributionProject:example projectPriority:'1'- name:create a basic distribution with defaults, tags and misconfigured custom SSL certificatecommunity.aws.cloudfront_distribution:state:presentcaller_reference:my-distribution-ssl-misconfigureddefault_origin_domain_name:www.my-cloudfront-origin.comviewer_certificate:acm_certificate_arn:arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012tags:Name:example distributionProject:example projectPriority:'1'
1
2
rulesets:- Ansible / AWS # Rules to enforce / AWS.
Request a personalized demo
Get Started with Datadog
Ask AI
AI-generated responses may be inaccurate. Verify important info.
