7

I'm using a tool to do security checks and this tool marked the following ciphers as weak:

TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003C)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xC027)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xC028)

I'm using the latest CloudFront Security Policy which is TLSv1.2_2018 and the Minimum Origin SSL Protocol set to TLSv1.2.

But even with these settings the weak ciphers is still allowed.

Is it possible to disable some specific ciphers on CloudFront?

1 Answer 1

12

AWS doesn't allow customers to choose individual ciphers for Amazon CloudFront. Instead it allows customers to choose between different security policies. The available security policies are listed in their documentation. As of now TLSv1.2_2018 is the latest security policy they offer and also the one they recommend customers to use. This policy includes the three ciphers you'd like to disable, so there is currently no way to use TLS with AWS CloudFront without these ciphers.

Aside from the security policies offered to customers right now, AWS has already defined newer security policies for use with Amazon CloudFront in s2n, the TLS-implementation they use for most of their public facing products.

Looking into the source code of s2n reveals the following additional security policies and the ciphers they support:

TLSv1.2_2019:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

TLSv1.2_2020:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

The latest security policy (TLSv1.2_2020) doesn't include the three ciphers you want to disable anymore, so whenever AWS decides to make this security policy available to its customers, you'll be able to disable the ciphers in question.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.