aws / aws/aws-cdk

aws-cloudfront: when using VIP ssl support method, minimum protocol version is incorrectly set

Open
#28,940 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-cloudfront bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When creating a distribution for a VIP `sslSupportMethod` distribution the resource handler returns an error message that the "The specified MinimumProtocolVersion cannot be used
with the specified SSLSupportMethod".

### Expected Behavior

The cloudfront distribution is created.

### Current Behavior

The distribution fails to create with messages such as:

```
17:43:12 | UPDATE_FAILED | AWS::CloudFront::Distribution | XXXXXXXXX
Resource handler returned message: "Invalid request provided: The specified MinimumProtocolVersion cannot be used
with the specified SSLSupportMethod (Service: CloudFront, Status Code: 400, Request ID: xxxxx)" (RequestToken: xxxxx HandlerErrorCode: InvalidRequest)
```

### Reproduction Steps

```ts
new Distribution(this, "api.example.com", {
defaultBehavior: {
origin: new HttpOrigin("api.example.com", {
originSslProtocols: [OriginSslPolicy.TLS_V1_2],
}),
viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
},
domainNames: ["test.example.com"],
certificate: props.certificate,
sslSupportMethod: SSLMethod.VIP,
});
```

### Possible Solution

I believe https://github.com/aws/aws-cdk/blob/95d187e4aabf69b7210ffdf53e53eda077b46d6e/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts#L679 is setting a minimumProtocolVersion, but should not if the `sslSupportMethod` is `SSLMethod.VIP`.

### Additional Information/Context

_No response_

### CDK CLI Version

2.104.0 (build 3b99abe)

### Framework Version

_No response_

### Node.js Version

v18.13.0

### OS

linux

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Inspect packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts around line 679, focusing on how minimumProtocolVersion is selected for SSLMethod.VIP. Use the reproduction steps to create the distribution and confirm it succeeds without the reported CloudFront error; done means VIP distributions no longer receive an incompatible minimum protocol version.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.