🧠 AWS CloudFront Web Distribution uses legacy Security Policy - prod.logic.yaml🟢

• Contextual name: 🧠 prod.logic.yaml🟢
• ID: /ce/ca/aws/cloudfront/distribution-security-policy/prod.logic.yaml
• Tags:
  • 🟢 Logic test success
  • 🟢 Logic with extracts
  • 🟢 Logic with test data

Uses

• 📗 AWS CloudFront Distribution
• 🔌 AWS CloudFront Distribution - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2025-12-27T12:01:42.297645304Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	001	✔️ 299	✔️ extract('CA10__viewerCertificateMinimumProtocolVersion__c').isEmpty()	✔️ null
🟢	002	✔️ 399	✔️ setOfText(['SSLv3', 'TLSv1', 'TLSv1_2016', 'TLSv1.1_2016', 'TLSv1.2_2018', 'TLSv1.2_2019']).contains(extract('CA10__viewerCertificateMinimumProtocolVersion__c'))	✔️ null
🟢	003	✔️ 400	✔️ otherwise	✔️ null

Generation Bundle

	File	MD5
Open	/ce/ca/aws/cloudfront/distribution-security-policy/policy.yaml	BD440DBEF14778586CD51131F04899D5
Open	/ce/ca/aws/cloudfront/distribution-security-policy/prod.logic.yaml	B0AC9435F919294FA2F89F16AD1DF9E1
Open	/ce/ca/aws/cloudfront/distribution-security-policy/test-data.json	BB7A373679CB77721ADAD7D7732EFFED
Open	/types/CA10__CaAwsDistribution__c/object.extracts.yaml	9BBABDA14FE5FD983E28F77F5CC80BF9

Available Commands

repo-manager policies generate FULL /ce/ca/aws/cloudfront/distribution-security-policy/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/cloudfront/distribution-security-policy/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/cloudfront/distribution-security-policy/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/cloudfront/distribution-security-policy/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/cloudfront/distribution-security-policy/prod.logic.yaml

Content

Open File

---
inputType: "CA10__CaAwsDistribution__c"
importExtracts:
  - file: "/types/CA10__CaAwsDistribution__c/object.extracts.yaml"
testData:
  - file: "test-data.json"  
recordTypes:
  - "caWebDistribution"
conditions:
  - status: "INCOMPLIANT"
    currentStateMessage: "Protocol version isn't set."
    remediationMessage: "Consider creating a security policy."
    check:
      IS_EMPTY:
        arg:
          EXTRACT: "CA10__viewerCertificateMinimumProtocolVersion__c"  
  - status: "INCOMPLIANT"
    currentStateMessage: "The CloudFront Distribution uses a legacy Security Policy."
    remediationMessage: "Update the Security Policy to a version enforcing at least TLSv1.2_2021."
    check:
      CONTAINS:
        arg:
          SET:
            itemType: TEXT
            items: 
              - "SSLv3"
              - "TLSv1"
              - "TLSv1_2016"
              - "TLSv1.1_2016"
              - "TLSv1.2_2018"
              - "TLSv1.2_2019"
        search:
          EXTRACT: "CA10__viewerCertificateMinimumProtocolVersion__c" 
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The CloudFront Distribution uses a current Security Policy."