aws-cloudfront: when using VIP ssl support method, minimum protocol version is incorrectly set

[MrPrimate]

Describe the bug

When creating a distribution for a VIP sslSupportMethod distribution the resource handler returns an error message that the "The specified MinimumProtocolVersion cannot be used
with the specified SSLSupportMethod".

Expected Behavior

The cloudfront distribution is created.

Current Behavior

The distribution fails to create with messages such as:

17:43:12 | UPDATE_FAILED        | AWS::CloudFront::Distribution    | XXXXXXXXX
Resource handler returned message: "Invalid request provided: The specified MinimumProtocolVersion cannot be used
with the specified SSLSupportMethod (Service: CloudFront, Status Code: 400, Request ID: xxxxx)" (RequestToken: xxxxx HandlerErrorCode: InvalidRequest)

Reproduction Steps

new Distribution(this, "api.example.com", {
	defaultBehavior: {
		origin: new HttpOrigin("api.example.com", {
			 originSslProtocols: [OriginSslPolicy.TLS_V1_2],
		}),
		viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
	},
	domainNames: ["test.example.com"],
	certificate: props.certificate,
	sslSupportMethod: SSLMethod.VIP,
});

Possible Solution

I believe

aws-cdk/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

Line 679 in 95d187e

const minimumProtocolVersion = minimumProtocolVersionProp ?? defaultVersion;

is setting a minimumProtocolVersion, but should not if the sslSupportMethod is SSLMethod.VIP.

Additional Information/Context

No response

CDK CLI Version

2.104.0 (build 3b99abe)

Framework Version

No response

Node.js Version

v18.13.0

OS

linux

Language

TypeScript

Language Version

No response

Other information

No response

[MrPrimate]

Having done a bit more digging here, the minimumProtocolVersion needs to be set to SecurityPolicyProtocol.TLS_V1 at the top level, rather than one of the subsets. Not sure if this is an actual bug with CDK at this point.

[pahud]

@MrPrimate

Can you share your workaround snippets? Thank you.

[MrPrimate]

@MrPrimate

Can you share your workaround snippets? Thank you.

Yes, I ended up using:

new Distribution(this, "api.example.com", {
	defaultBehavior: {
		origin: new HttpOrigin("api.example.com", {
			 originSslProtocols: [OriginSslPolicy.TLS_V1_2],
		}),
		viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
	},
	domainNames: ["test.example.com"],
	certificate: props.certificate,
	sslSupportMethod: SSLMethod.VIP,
	minimumProtocolVersion: SecurityPolicyProtocol.TLS_V1,
});

It's the minimumProtocolVersion: SecurityPolicyProtocol.TLS_V1 that needs to be defaulted if sslSupportMethod: SSLMethod.VIP, is set