CloudFront MinimumProtocolVersion silently ignored with default certificate

[giordafrancis]

The CDK code in lib/features/web.ts explicitly sets minimumProtocolVersion on the CloudFront distribution (both custom domain and default certificate branches). However, when using the default CloudFront certificate (no custom domain configured), the deployed distribution shows TLSv1 as the minimum protocol instead of the value specified in the code.

Environment:

• AWS region: eu-west-2
• Default CloudFront certificate (no custom domain)
• CDK aws-cdk-lib 2.153.0

Steps to reproduce:

• Deploy the app without a custom domain
• Run aws cloudfront get-distribution-config --id --query 'DistributionConfig.ViewerCertificate'
• Observe MinimumProtocolVersion shows TLSv1 despite the code setting TLS_V1_2_2021

Expected behaviour: MinimumProtocolVersion should reflect the value set in the CDK code. That is my asumption even if using cloudfront custom domain.

Additional context: Flagged during penetration testing ; the distribution accepts TLS connections below 1.2, which does not meet organisational security requirements.

[giordafrancis]

Confirmed root cause: this is expected AWS behaviour, not a CDK bug. Per AWS docs, when CloudFrontDefaultCertificate is true, CloudFront always forces TLSv1 regardless of minimumProtocolVersion. Also tracked here: aws/aws-cdk#35404.

Also found this was already flagged by cdk-nag and suppressed in web.ts (~line 103):

{
id: "AwsSolutions-CFR4",
reason: "Custom certificate is not in scope for this prototype",
}

That's a fair call for a prototype, but it means anyone expecting to use this in production without revisiting it silently inherits TLSv1.

Suggested fix: rather than relying on users to discover this after the fact (e.g. via pentest), surface it at install time ; a warning during cdk deploy/ or the actual installer when no custom domain is configured, stating that minimumProtocolVersion will be ignored and TLSv1 will apply, with a recommendation to configure a custom domain + cert for production use.