From 44f5139df6106e285043722f8830051dbfd80636 Mon Sep 17 00:00:00 2001 From: "Benito J. Gonzalez" Date: Tue, 4 Aug 2026 11:31:41 -0700 Subject: [PATCH] Issue #1119: enforce TLS 1.2+ on ALB + CloudFront (drop TLS 1.0/1.1) Cyber-insurance review flagged public LIF endpoints for allowing TLS 1.0/1.1. Neither stack pinned a TLS floor, so both fell back to permissive AWS defaults. - service-common.yml: set SslPolicy ELBSecurityPolicy-TLS13-1-2-2021-06 on the shared 443 listener (was defaulting to ELBSecurityPolicy-2016-08 = TLS 1.0+). Covers advisor.demo / dev.lif / demo.lif (dev + demo shared ALBs). - s3-hosted.yml: set MinimumProtocolVersion TLSv1.2_2021 on the CloudFront ViewerCertificate (was defaulting to TLSv1). Covers mdr.dev and any frontend built from this template. Both are no-downtime updates. Deploy = redeploy {dev,demo}-lif-common + each s3-hosted frontend stack. Closes #1119 Co-Authored-By: Claude Opus 4.8 --- cloudformation/s3-hosted.yml | 4 ++++ cloudformation/service-common.yml | 8 ++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/cloudformation/s3-hosted.yml b/cloudformation/s3-hosted.yml index cab86e9e..cdb44f7c 100644 --- a/cloudformation/s3-hosted.yml +++ b/cloudformation/s3-hosted.yml @@ -91,6 +91,10 @@ Resources: ViewerCertificate: AcmCertificateArn: !Ref SSLCertificate SslSupportMethod: sni-only + # Pin TLS 1.2+ for viewers. Without this, a custom-cert distribution + # defaults to MinimumProtocolVersion TLSv1, which permits TLS 1.0/1.1 + # (encryption-policy violation flagged by cyber insurance, 2026-08). + MinimumProtocolVersion: TLSv1.2_2021 Tags: - Key: Name Value: !Sub '${EnvironmentName}-${ServiceName}-cloudfront' diff --git a/cloudformation/service-common.yml b/cloudformation/service-common.yml index 502643bc..347baf3c 100644 --- a/cloudformation/service-common.yml +++ b/cloudformation/service-common.yml @@ -488,9 +488,13 @@ Resources: LoadBalancerArn: !Ref LoadBalancer - Port: 443 + Port: 443 Protocol: HTTPS - Certificates: + # Pin TLS 1.2+1.3 only. Without an explicit policy the listener defaults to + # ELBSecurityPolicy-2016-08, which still permits TLS 1.0/1.1 (encryption-policy + # violation flagged by cyber insurance, 2026-08). + SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06 + Certificates: - CertificateArn: !Ref SSLCertificate SSLCertificate: