Issue #1119: enforce TLS 1.2+ on ALB + CloudFront (drop TLS 1.0/1.1) - #1120
Merged
Conversation
… TLS 1.0/1.1)
Cyber-insurance review flagged public LIF endpoints for allowing TLS 1.0/1.1.
Neither stack pinned a TLS floor, so both fell back to permissive AWS defaults.
- service-common.yml: set SslPolicy ELBSecurityPolicy-TLS13-1-2-2021-06 on the
shared 443 listener (was defaulting to ELBSecurityPolicy-2016-08 = TLS 1.0+).
Covers advisor.demo / dev.lif / demo.lif (dev + demo shared ALBs).
- s3-hosted.yml: set MinimumProtocolVersion TLSv1.2_2021 on the CloudFront
ViewerCertificate (was defaulting to TLSv1). Covers mdr.dev and any frontend
built from this template.
Both are no-downtime updates. Deploy = redeploy {dev,demo}-lif-common + each
s3-hosted frontend stack.
Closes LIF-Initiative#1119
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-project-automation
Bot
moved this from Backlog
to Done
in Current Community Efforts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remediates the cyber-insurance encryption-policy finding (TLS 1.0/1.1 on public LIF endpoints). Root cause: neither stack pinned a TLS floor, so both used permissive AWS defaults.
Changes
cloudformation/service-common.yml— shared 443 listener (LoadBalancerHttpsListener) now setsSslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06(TLS 1.2+1.3 only). Was defaulting toELBSecurityPolicy-2016-08(permits 1.0/1.1). Covers advisor.demo / dev.lif / demo.lif (dev + demo shared ALBs).cloudformation/s3-hosted.yml— CloudFrontViewerCertificatenow setsMinimumProtocolVersion: TLSv1.2_2021. Was defaulting toTLSv1. Covers mdr.dev and any frontend built from this template.Scope note
lif.unicon.net(apex) does not resolve to this account — likely corporateunicon.netDNS, out of scope here; confirm with the insurer.Rollout (no downtime)
Redeploy the affected stacks:
dev-lif-common+demo-lif-common(ALB listener update is instant), and each frontend'ss3-hostedstack (CloudFront ~minutes to propagate).Verify after deploy
aws elbv2 describe-listeners --query 'Listeners[?Port==\443`].SslPolicy'andaws cloudfront get-distribution-config→MinimumProtocolVersion`.Deploy is on shared dev+demo infra — opening for review/merge rather than deploying unprompted.
Closes #1119
🤖 Generated with Claude Code