feat(cloudfront): warn users that minimumProtocolVersion defaults to TLSv1 without a custom certificate by AkitoAndo · Pull Request #35416 · aws/aws-cdk

AkitoAndo · 2025-09-04T15:18:17Z

Issue # (if applicable)
Closes #35404

Reason for this change
Currently, AWS CDK allows setting minimumProtocolVersion on a CloudFront Distribution without requiring a custom SSL/TLS certificate. However, CloudFront silently ignores this setting when using its default certificate, defaulting to TLSv1 regardless of the configured value. This creates a security vulnerability where developers believe their distribution enforces TLS 1.2+ when it actually accepts TLS 1.0 and 1.1.

Description of changes
Added validation in the Distribution constructor to throw an error when minimumProtocolVersion is specified without a custom certificate
Added validation for sslSupportMethod as well, as it has the same dependency on custom certificates
The validation ensures that developers are explicitly aware that these security settings require a custom certificate to take effect
Added comprehensive unit tests to verify the validation logic
The validation logic checks if either minimumProtocolVersion or sslSupportMethod are set without a certificate, and throws a descriptive error message guiding users to provide a custom certificate.

Alternative considered: Adding a warning instead of an error for backward compatibility. However, given the security implications of this misconfiguration, a breaking change with clear error messaging was deemed more appropriate to prevent security vulnerabilities.

Describe any new or updated permissions being added
No new or updated IAM permissions are required for this change.

Description of how you validated changes
Added unit tests to verify that an error is thrown when minimumProtocolVersion is set without a certificate
Added unit tests to verify that an error is thrown when sslSupportMethod is set without a certificate
Added unit tests to confirm that no error is thrown when these properties are set with a valid certificate
Verified that existing tests pass with the new validation
Manually tested the changes by attempting to deploy a Distribution with the problematic configuration and confirming the error is raised during synthesis
Checklist
My code adheres to the [CONTRIBUTING GUIDE](https:/ /github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and
DESIGN GUIDELINES
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Add validation to prevent setting minimumProtocolVersion and sslSupportMethod without providing a custom certificate, which would cause CloudFormation deployment errors. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

aws-cdk-automation

(This review is outdated)

Add integration test to verify that minimumProtocolVersion and sslSupportMethod validation works correctly with and without custom certificates. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

AkitoAndo · 2025-09-04T15:27:07Z

@badmintoncryer
Your advice really helped me out! Thanks a lot!!

Add CloudFormation template snapshots for the certificate validation integration test. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Fix trailing whitespace errors in CloudFront distribution tests. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

dgandhi62 · 2025-09-05T20:03:47Z

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

+    // Validate that minimumProtocolVersion and sslSupportMethod are only specified with a certificate
+    if (!props.certificate) {
+      if (props.minimumProtocolVersion !== undefined) {
+        throw new ValidationError('minimumProtocolVersion can only be specified when using a custom certificate. Use the \'certificate\' property to provide a certificate.', this);


Throwing an error could potentially be a breaking change for existing users. Could we show a warning instead? We want to let the users know that CloudFront will default to TLSv1. The error message would change accordingly

Thank you for the feedback! I've updated the implementation to use Annotations.addWarningV2() instead of throwing a ValidationError.

dgandhi62 · 2025-09-05T20:21:12Z

...ework-integ/test/aws-cloudfront/test/integ.cloudfront-distribution-certificate-validation.ts

+new IntegTest(app, 'cloudfront-distribution-certificate-validation-test', {
+  testCases: [stack],
+});
+


You can consider leaving an assertion to verify that the test succeeds. Alternatively, try mentioning it in the PR why an assertion was not needed. The Integration Test guide has some helpful examples!

https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md

Thank you for the feedback. I've added assertions to the integration test to verify the CloudFront behavior.

dgandhi62 · 2025-09-05T20:22:09Z

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

+        throw new ValidationError('sslSupportMethod can only be specified when using a custom certificate. Use the \'certificate\' property to provide a certificate.', this);
+      }
+    }
+


Likewise for sslSuportMethod

Based on PR feedback: - Change ValidationError to warning when minimumProtocolVersion or sslSupportMethod are specified without a certificate - Update unit tests to verify warnings instead of errors - Add assertions to integration test to verify CloudFront behavior This maintains backward compatibility while informing users that CloudFront will use defaults (TLSv1 for protocol, SNI for method) when no custom certificate is provided. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

AkitoAndo · 2025-09-07T04:23:51Z

@dgandhi62 Thanks for the review! I've updated the PR based on your feedback:

Changed ValidationError to warnings for backward compatibility
Added explicit default behavior in warning messages (TLSv1, SNI)
Added assertions to the integration test
Updated all unit tests accordingly

Ready for re-review when you have time. Thank you 🙇

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation · 2025-09-27T00:11:40Z

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. Note that PRs with failing linting check or builds are not reviewed, please ensure your build is passing

To prevent automatic closure:

Resume work on the PR
OR request an exemption by adding a comment containing 'Exemption Request' with justification e.x "Exemption Request: "
OR request clarification by adding a comment containing 'Clarification Request' with a question e.x "Clarification Request: "

This PR will automatically close in 14 days if no action is taken.

aws-cdk-automation · 2025-10-12T00:12:28Z

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

github-actions · 2025-10-12T00:12:39Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

github-actions bot added beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK bug This issue is a bug. effort/small Small work item – less than a day of effort p1 labels Sep 4, 2025

aws-cdk-automation requested a review from a team September 4, 2025 15:18

aws-cdk-automation previously requested changes Sep 4, 2025

View reviewed changes

AkitoAndo requested a review from aws-cdk-automation September 4, 2025 15:27

AkitoAndo changed the title ~~fix(cloudfront): Don't allow minimumProtocolVersion on default cert~~ fix(cloudfront): dont allow minimumProtocolVersion on default cert Sep 4, 2025

test: add integration test snapshots for certificate validation

5f87e20

Add CloudFormation template snapshots for the certificate validation integration test. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

kaizencc self-assigned this Sep 4, 2025

style: fix ESLint trailing spaces in distribution.test.ts

f78bf6f

Fix trailing whitespace errors in CloudFront distribution tests. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>

dgandhi62 self-requested a review September 5, 2025 19:11

dgandhi62 requested changes Sep 5, 2025

View reviewed changes

dgandhi62 changed the title ~~fix(cloudfront): dont allow minimumProtocolVersion on default cert~~ feat(cloudfront): warning users on minimumProtocolVersion defaulting to TLSv1 without a custom certificate Sep 8, 2025

aws-cdk-automation previously requested changes Sep 8, 2025

View reviewed changes

kaizencc added the pr-linter/exempt-readme The PR linter will not require README changes label Sep 9, 2025

kaizencc changed the title ~~feat(cloudfront): warning users on minimumProtocolVersion defaulting to TLSv1 without a custom certificate~~ feat(cloudfront): warn users that minimumProtocolVersion defaults to TLSv1 without a custom certificate Sep 9, 2025

github-actions bot mentioned this pull request Oct 1, 2025

Monthly PR metrics report #35642

Open

aws-cdk-automation added the closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. label Oct 12, 2025

aws-cdk-automation closed this Oct 12, 2025

github-actions bot locked as resolved and limited conversation to collaborators Oct 12, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cloudfront): warn users that minimumProtocolVersion defaults to TLSv1 without a custom certificate#35416

feat(cloudfront): warn users that minimumProtocolVersion defaults to TLSv1 without a custom certificate#35416
AkitoAndo wants to merge 5 commits intoaws:mainfrom
AkitoAndo:fix/cloudfront-distribution-clean

AkitoAndo commented Sep 4, 2025

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

AkitoAndo commented Sep 4, 2025

Uh oh!

dgandhi62 Sep 5, 2025

Uh oh!

AkitoAndo Sep 7, 2025

Uh oh!

dgandhi62 Sep 5, 2025

Uh oh!

AkitoAndo Sep 7, 2025

Uh oh!

dgandhi62 Sep 5, 2025

Uh oh!

AkitoAndo commented Sep 7, 2025

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

aws-cdk-automation commented Sep 27, 2025

Uh oh!

aws-cdk-automation commented Oct 12, 2025

Uh oh!

github-actions bot commented Oct 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

AkitoAndo commented Sep 4, 2025

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AkitoAndo commented Sep 4, 2025

Uh oh!

dgandhi62 Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

AkitoAndo Sep 7, 2025

Choose a reason for hiding this comment

Uh oh!

dgandhi62 Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

AkitoAndo Sep 7, 2025

Choose a reason for hiding this comment

Uh oh!

dgandhi62 Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

AkitoAndo commented Sep 7, 2025

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation commented Sep 27, 2025

Uh oh!

aws-cdk-automation commented Oct 12, 2025

Uh oh!

github-actions bot commented Oct 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading