feat: updating CloudWatch minimum TLS policy (WRSAT-670)

Author: cram-cfa

main.tf

@@ -98,7 +98,7 @@ resource "aws_cloudfront_distribution" "waf" {
   viewer_certificate {
     acm_certificate_arn      = var.certificate_imported ? data.aws_acm_certificate.imported["this"].arn : aws_acm_certificate.subdomain.arn
     ssl_support_method       = "sni-only"
-    minimum_protocol_version = "TLSv1.2_2021"
+    minimum_protocol_version = var.minimum_protocol_version
   }
 
   tags = merge(local.tags, { Name : local.fqdn })

variables.tf

@@ -59,6 +59,12 @@ variable "log_group" {
   description = "CloudWatch log group to send WAF logs to."
 }
 
+variable "minimum_protocol_version" {
+  type        = string
+  description = "Minimum CloudWatch TLS security policy."
+  default     = "TLSv1.2_2025"
+}
+
 variable "origin_alb_arn" {
   type        = string
   description = <<-EOT