aws-cloudfront: when using VIP ssl support method, minimum protocol version is incorrectly set
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When creating a distribution for a VIP `sslSupportMethod` distribution the resource handler returns an error message that the "The specified MinimumProtocolVersion cannot be used
with the specified SSLSupportMethod".
### Expected Behavior
The cloudfront distribution is created.
### Current Behavior
The distribution fails to create with messages such as:
```
17:43:12 | UPDATE_FAILED | AWS::CloudFront::Distribution | XXXXXXXXX
Resource handler returned message: "Invalid request provided: The specified MinimumProtocolVersion cannot be used
with the specified SSLSupportMethod (Service: CloudFront, Status Code: 400, Request ID: xxxxx)" (RequestToken: xxxxx HandlerErrorCode: InvalidRequest)
```
### Reproduction Steps
```ts
new Distribution(this, "api.example.com", {
defaultBehavior: {
origin: new HttpOrigin("api.example.com", {
originSslProtocols: [OriginSslPolicy.TLS_V1_2],
}),
viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
},
domainNames: ["test.example.com"],
certificate: props.certificate,
sslSupportMethod: SSLMethod.VIP,
});
```
### Possible Solution
I believe https://github.com/aws/aws-cdk/blob/95d187e4aabf69b7210ffdf53e53eda077b46d6e/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts#L679 is setting a minimumProtocolVersion, but should not if the `sslSupportMethod` is `SSLMethod.VIP`.
### Additional Information/Context
_No response_
### CDK CLI Version
2.104.0 (build 3b99abe)
### Framework Version
_No response_
### Node.js Version
v18.13.0
### OS
linux
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Inspect packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts around line 679, focusing on how minimumProtocolVersion is selected for SSLMethod.VIP. Use the reproduction steps to create the distribution and confirm it succeeds without the reported CloudFront error; done means VIP distributions no longer receive an incompatible minimum protocol version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 42/100