fix(cloudformation): fix FP on CloudFront Without Minimum Protocol TLS 1.2

assets/libraries/common.rego

@@ -482,7 +482,7 @@ any_principal(statement) {
 }
 
 is_recommended_tls(field) {
-	inArray({"TLSv1.2_2018", "TLSv1.2_2019", "TLSv1.2_2021"}, field)
+	inArray({"TLSv1.2_2018", "TLSv1.2_2019", "TLSv1.2_2021","TLSv1.2_2025", "TLSv1.3_2025"}, field)
 }
 
 is_unrestricted(sourceRange) {

assets/queries/cloudFormation/aws/cloudfront_without_minimum_protocol_tls_1.2/test/negative3.json

@@ -0,0 +1,52 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z",
+  "Resources": {
+    "cloudfrontdistribution": {
+      "Type": "AWS::CloudFront::Distribution",
+      "Properties": {
+        "DistributionConfig": {
+          "CacheBehaviors": [
+            {
+              "LambdaFunctionAssociations": [
+                {
+                  "EventType": "string-value",
+                  "LambdaFunctionARN": "string-value"
+                }
+              ]
+            }
+          ],
+          "DefaultCacheBehavior": {
+            "LambdaFunctionAssociations": [
+              {
+                "EventType": "string-value",
+                "LambdaFunctionARN": "string-value"
+              }
+            ]
+          },
+          "IPV6Enabled": "boolean-value",
+          "Origins": [
+            {
+              "CustomOriginConfig": {
+                "OriginKeepaliveTimeout": "integer-value",
+                "OriginReadTimeout": "integer-value"
+              }
+            }
+          ],
+          "ViewerCertificate": {
+            "IamCertificateId": "String",
+            "MinimumProtocolVersion": "TLSv1.2_2025",
+            "SslSupportMethod": "String",
+            "AcmCertificateArn": "String",
+            "CloudFrontDefaultCertificate": true
+          }
+        },
+        "Tags": [
+          {
+            "Key": "string-value",
+            "Value": "string-value"
+          }
+        ]
+      }
+    }
+  }
+}

assets/queries/cloudFormation/aws/cloudfront_without_minimum_protocol_tls_1.2/test/negative4.yaml

@@ -0,0 +1,28 @@
+AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  cloudfrontdistribution:
+    Type: AWS::CloudFront::Distribution
+    Properties:
+      DistributionConfig:
+        CacheBehaviors:
+          - LambdaFunctionAssociations:
+              - EventType: string-value
+                LambdaFunctionARN: string-value
+        DefaultCacheBehavior:
+          LambdaFunctionAssociations:
+            - EventType: string-value
+              LambdaFunctionARN: string-value
+        IPV6Enabled: boolean-value
+        Origins:
+          - CustomOriginConfig:
+              OriginKeepaliveTimeout: integer-value
+              OriginReadTimeout: integer-value
+        ViewerCertificate:
+          AcmCertificateArn: String
+          CloudFrontDefaultCertificate: true
+          IamCertificateId: String
+          MinimumProtocolVersion: "TLSv1.2_2025"
+          SslSupportMethod: String
+      Tags:
+        - Key: string-value
+          Value: string-value

assets/queries/cloudFormation/aws/cloudfront_without_minimum_protocol_tls_1.2/test/negative5.json

@@ -0,0 +1,52 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z",
+  "Resources": {
+    "cloudfrontdistribution": {
+      "Type": "AWS::CloudFront::Distribution",
+      "Properties": {
+        "DistributionConfig": {
+          "CacheBehaviors": [
+            {
+              "LambdaFunctionAssociations": [
+                {
+                  "EventType": "string-value",
+                  "LambdaFunctionARN": "string-value"
+                }
+              ]
+            }
+          ],
+          "DefaultCacheBehavior": {
+            "LambdaFunctionAssociations": [
+              {
+                "EventType": "string-value",
+                "LambdaFunctionARN": "string-value"
+              }
+            ]
+          },
+          "IPV6Enabled": "boolean-value",
+          "Origins": [
+            {
+              "CustomOriginConfig": {
+                "OriginKeepaliveTimeout": "integer-value",
+                "OriginReadTimeout": "integer-value"
+              }
+            }
+          ],
+          "ViewerCertificate": {
+            "IamCertificateId": "String",
+            "MinimumProtocolVersion": "TLSv1.3_2025",
+            "SslSupportMethod": "String",
+            "AcmCertificateArn": "String",
+            "CloudFrontDefaultCertificate": true
+          }
+        },
+        "Tags": [
+          {
+            "Key": "string-value",
+            "Value": "string-value"
+          }
+        ]
+      }
+    }
+  }
+}

assets/queries/cloudFormation/aws/cloudfront_without_minimum_protocol_tls_1.2/test/negative6.yaml

@@ -0,0 +1,28 @@
+AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  cloudfrontdistribution:
+    Type: AWS::CloudFront::Distribution
+    Properties:
+      DistributionConfig:
+        CacheBehaviors:
+          - LambdaFunctionAssociations:
+              - EventType: string-value
+                LambdaFunctionARN: string-value
+        DefaultCacheBehavior:
+          LambdaFunctionAssociations:
+            - EventType: string-value
+              LambdaFunctionARN: string-value
+        IPV6Enabled: boolean-value
+        Origins:
+          - CustomOriginConfig:
+              OriginKeepaliveTimeout: integer-value
+              OriginReadTimeout: integer-value
+        ViewerCertificate:
+          AcmCertificateArn: String
+          CloudFrontDefaultCertificate: true
+          IamCertificateId: String
+          MinimumProtocolVersion: "TLSv1.3_2025"
+          SslSupportMethod: String
+      Tags:
+        - Key: string-value
+          Value: string-value

assets/queries/cloudFormation/aws/cloudfront_without_minimum_protocol_tls_1.2/test/positive3.yaml

@@ -0,0 +1,50 @@
+AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  cloudfrontdistribution:
+    Type: AWS::CloudFront::Distribution
+    Properties:
+      DistributionConfig:
+        Enabled: false
+        CacheBehaviors:
+          - LambdaFunctionAssociations:
+              - EventType: string-value
+                LambdaFunctionARN: string-value
+        DefaultCacheBehavior:
+          LambdaFunctionAssociations:
+            - EventType: string-value
+              LambdaFunctionARN: string-value
+        IPV6Enabled: boolean-value
+        Origins:
+          - CustomOriginConfig:
+              OriginKeepaliveTimeout: integer-value
+              OriginReadTimeout: integer-value
+        ViewerCertificate:
+          AcmCertificateArn: String
+          CloudFrontDefaultCertificate: true
+          IamCertificateId: String
+          MinimumProtocolVersion: "TLSv1.3_2025"
+          SslSupportMethod: String
+      Tags:
+        - Key: string-value
+          Value: string-value
+  cloudfrontdistribution2:
+    Type: AWS::CloudFront::Distribution
+    Properties:
+      DistributionConfig:
+        Enabled: true
+        CacheBehaviors:
+          - LambdaFunctionAssociations:
+              - EventType: string-value
+                LambdaFunctionARN: string-value
+        DefaultCacheBehavior:
+          LambdaFunctionAssociations:
+            - EventType: string-value
+              LambdaFunctionARN: string-value
+        IPV6Enabled: boolean-value
+        Origins:
+          - CustomOriginConfig:
+              OriginKeepaliveTimeout: integer-value
+              OriginReadTimeout: integer-value
+      Tags:
+        - Key: string-value
+          Value: string-value

assets/queries/cloudFormation/aws/cloudfront_without_minimum_protocol_tls_1.2/test/positive4.json

@@ -0,0 +1,94 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z",
+  "Resources": {
+    "cloudfrontdistribution": {
+      "Type": "AWS::CloudFront::Distribution",
+      "Properties": {
+        "DistributionConfig": {
+          "Enabled": false,
+          "ViewerCertificate": {
+            "IamCertificateId": "String",
+            "MinimumProtocolVersion": "TLSv1.1_2016",
+            "SslSupportMethod": "String",
+            "AcmCertificateArn": "String",
+            "CloudFrontDefaultCertificate": true
+          },
+          "CacheBehaviors": [
+            {
+              "LambdaFunctionAssociations": [
+                {
+                  "EventType": "string-value",
+                  "LambdaFunctionARN": "string-value"
+                }
+              ]
+            }
+          ],
+          "DefaultCacheBehavior": {
+            "LambdaFunctionAssociations": [
+              {
+                "EventType": "string-value",
+                "LambdaFunctionARN": "string-value"
+              }
+            ]
+          },
+          "IPV6Enabled": "boolean-value",
+          "Origins": [
+            {
+              "CustomOriginConfig": {
+                "OriginKeepaliveTimeout": "integer-value",
+                "OriginReadTimeout": "integer-value"
+              }
+            }
+          ]
+        },
+        "Tags": [
+          {
+            "Key": "string-value",
+            "Value": "string-value"
+          }
+        ]
+      }
+    },
+    "cloudfrontdistribution2": {
+      "Type": "AWS::CloudFront::Distribution",
+      "Properties": {
+        "DistributionConfig": {
+          "Enabled": true,
+          "Origins": [
+            {
+              "CustomOriginConfig": {
+                "OriginKeepaliveTimeout": "integer-value",
+                "OriginReadTimeout": "integer-value"
+              }
+            }
+          ],
+          "CacheBehaviors": [
+            {
+              "LambdaFunctionAssociations": [
+                {
+                  "EventType": "string-value",
+                  "LambdaFunctionARN": "string-value"
+                }
+              ]
+            }
+          ],
+          "DefaultCacheBehavior": {
+            "LambdaFunctionAssociations": [
+              {
+                "LambdaFunctionARN": "string-value",
+                "EventType": "string-value"
+              }
+            ]
+          },
+          "IPV6Enabled": "boolean-value"
+        },
+        "Tags": [
+          {
+            "Key": "string-value",
+            "Value": "string-value"
+          }
+        ]
+      }
+    }
+  }
+}

assets/queries/cloudFormation/aws/cloudfront_without_minimum_protocol_tls_1.2/test/positive_expected_result.json

@@ -12,15 +12,27 @@
     "fileName": "positive1.yaml"
   },
   {
-    "line": 55,
-    "fileName": "positive2.json",
+    "severity": "MEDIUM",
     "queryName": "CloudFront Without Minimum Protocol TLS 1.2",
-    "severity": "MEDIUM"
+    "line": 55,
+    "fileName": "positive2.json"
   },
   {
+    "queryName": "CloudFront Without Minimum Protocol TLS 1.2",
     "severity": "MEDIUM",
     "line": 11,
-    "fileName": "positive2.json",
-    "queryName": "CloudFront Without Minimum Protocol TLS 1.2"
+    "fileName": "positive2.json"
+  },
+  {
+    "queryName": "CloudFront Without Minimum Protocol TLS 1.2",
+    "severity": "MEDIUM",
+    "line": 33,
+    "fileName": "positive3.yaml"
+  },
+  {
+    "queryName": "CloudFront Without Minimum Protocol TLS 1.2",
+    "severity": "MEDIUM",
+    "line": 55,
+    "fileName": "positive4.json"
   }
-]
+]