Disclaimer: Internal engineering gap-check only. Not a formal QSA assessment. Formal compliance requires a Qualified Security Assessor (QSA). Read-only automated collection; no AWS resources were modified.
TLS posture across CloudFront, ACM certificates, API Gateway, load balancers and S3 transport policy.
CloudFront TLSCert validityS3 TLS-onlyAPI TLS
4.2 — CloudFront Viewer TLS
| Distribution | Min TLS | Viewer Policy | Status |
|---|
| adm**** | TLSv1.2_2019 | redirect-to-https | Compliant |
| api**** | TLSv1.2_2019 | redirect-to-https | Compliant |
| log**** | TLSv1.2_2019 | redirect-to-https | Compliant |
| for**** | TLSv1.2_2019 | redirect-to-https | Compliant |
| log**** | TLSv1.2_2021 | redirect-to-https | Compliant |
| for**** | TLSv1.2_2021 | redirect-to-https | Compliant |
| por**** | TLSv1.2_2021 | redirect-to-https | Compliant |
4.2 — ACM Certificate Validity
| Domain | Status | Days to Expiry | In Use By | Status |
|---|
| hel**** | EXPIRED | -1935 | 0 | Gap |
| *.rev**** | ISSUED | 56 | 2 | Needs Review |
| *.hel**** | ISSUED | 130 | 4 | Compliant |
| por**** | ISSUED | 123 | 1 | Compliant |
No Application/Network Load Balancers present — public TLS termination handled at CloudFront/API Gateway.
4.2 — API Gateway Stages (managed TLS)
| API | Stage | Transport | Access Logs | Status |
|---|
| Payment Gateway API | v1 | TLS (managed edge) | Yes | Compliant |
| Security Automations - WAF Bad Bot API | CFDeploymentStage | TLS (managed edge) | No | Compliant |
| Security Automations - WAF Bad Bot API | ProdStage | TLS (managed edge) | No | Compliant |
4.2 — S3 aws:SecureTransport Enforcement
| Bucket | Deny insecure transport | Status |
|---|
| adm**** | NO | Gap |
| aws-cloudtrail-logs-501****-aa073ab8 | NO | Gap |
| bac**** | NO | Gap |
| cdk-hnb659fds-assets-501****-us-east-1 | Yes | Compliant |
| cf-templates-e4zlcd7q18st-us-east-2 | NO | Gap |
| cod**** | NO | Gap |
| for**** | NO | Gap |
| hp-cf-logging | NO | Gap |
| hp-vpc-flowlog | NO | Gap |
| hptuat-mongodumps | NO | Gap |
| hptwarmeeting | NO | Gap |
| log**** | NO | Gap |
| por**** | NO | Gap |
| regionalapi-s3bucketaccesslogs-wrzn070su9k7 | NO | Gap |
| rev**** | NO | Gap |
| v1-501****-hpg-artifactstore | NO | Gap |
| v1-501****-hpg-artifactstore-backup | NO | Gap |
| v1-501****-hpg-secretstore | NO | Gap |
| v1-501****-hpt-itemstore | NO | Gap |
| v1-501****-hpt-patientdocs | NO | Gap |
| v1-501****-hpt-uploadpatientstore | NO | Gap |
Control Mapping
| Control | Description | Status | Evidence |
|---|
| 4.2.1 (CDN) | Strong TLS for public HTTPS (CloudFront TLS1.2+ & HTTPS redirect) | Compliant | 7/7 distributions TLS1.2+ & HTTPS-only/redirect |
| 4.2.1 (Certs) | Valid, non-expired TLS certificates | Gap | 1 expired, 1 expiring<60d, of 4 certs |
| 4.2.1 (ALB) | Load balancer TLS | N/A | No ELBv2 load balancers in account |
| 4.2.1 (API) | API Gateway enforces HTTPS (AWS-managed TLS endpoint) | Compliant | 2 REST API(s), TLS terminated by AWS |
| 4.2.1 (S3 TLS) | S3 bucket policy denies non-TLS (aws:SecureTransport=false) | Gap | 1/21 buckets enforce TLS-only |
Recommendations
MediumRemove or replace EXPIRED ACM certificate(s): hel**** (not currently in use, but should be cleaned up).
MediumRenew certificate(s) approaching expiry (<60 days): *.rev****.
HighAdd an aws:SecureTransport=false Deny statement to bucket policies for 20 bucket(s) to reject clear-text HTTP access.
ProcessMaintain an inventory of trusted keys/certs used to protect PAN in transit (PCI 4.2.1.1).