VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

Verify that AWS CloudFront distributions do not allow SSLv3 for communication with custom origins. This check matches AWS Security Hub control CloudFront.10.

Rationale

SSLv3 is deprecated and does not provide adequate protection for traffic between CloudFront edge locations and custom origins.

Remediation

From the console

Follow the CloudFront.10 remediation guidance to remove SSLv3 from each custom origin’s allowed SSL protocols.

From the command line

1. Run get-distribution-config with your AWS CloudFront distribution ID to retrieve your distribution’s configuration information.

   get-distribution-config.sh

   Copy

       aws cloudfront get-distribution-config
           --id ID000000000000
       

2. In a new JSON file, modify the returned configuration. Remove SSLv3 from OriginSslProtocols and save the configuration file.

   https-only.sh

   Copy

       {
         "ETag": "ETAG0000000000",
         "DistributionConfig": {
           "Origins": {
             "Items": [
               {
                 "CustomOriginConfig": {
                   "OriginSslProtocols": {
                     "Items": ["TLSv1.2"],
                     "Quantity": 1
                   },
                   ...
                 }
               }
             ]
           }
         }
       }
       

3. Run update-distribution to update your distribution with your distribution id, the path of the configuration file (created in step 2), and your etag.

   update-distribution.sh

   Copy

       aws cloudfront update-distribution
           --id ID000000000000
           --distribution-config https-only.json
           --if-match ETAG0000000000