CloudFront distributions should use the recommended TLS security policy

How to fix it

Set the distribution's security policy to one of the three AWS recommends: TLSv1.2_2021, TLSv1.2_2025 or TLSv1.3_2025. Read the access logs before moving, because they record the negotiated protocol and cipher for every request and are the only way to know whether anything still needs TLS 1.0 or 1.1: a viewer that cannot meet the new policy gets a failed handshake rather than a downgrade, so it never reaches your application and nothing in your own logs shows it. A distribution on the CloudFront default certificate is out of scope, because CloudFront pins its policy to TLSv1 whatever value is sent; the route to a modern policy there is the custom certificate CloudFront.7 asks for.

In the console

CloudFront → Distributions → the distribution → General → Settings → Security policy