# SecurityPolicyProtocol

The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.

CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify.

- Source: [`aws-cloudfront/lib/distribution.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts#L1003)
- Type last changed: v2.221.0 · 24 Oct 2025

## Example

```ts
    const s3BucketSource = new s3.Bucket(this, 'Bucket');

    const distribution = new cloudfront.CloudFrontWebDistribution(this, 'AnAmazingWebsiteProbably', {
      originConfigs: [{
        s3OriginSource: { s3BucketSource },
        behaviors: [{ isDefaultBehavior: true }],
      }],
      viewerCertificate: cloudfront.ViewerCertificate.fromIamCertificate(
        'certificateId',
        {
          aliases: ['example.com'],
          securityPolicy: cloudfront.SecurityPolicyProtocol.SSL_V3, // default
          sslMethod: cloudfront.SSLMethod.SNI, // default
        },
      ),
    });
```

## Members

| Member | Description |
| --- | --- |
| `SSL_V3` |  |
| `TLS_V1` |  |
| `TLS_V1_2016` |  |
| `TLS_V1_1_2016` |  |
| `TLS_V1_2_2018` |  |
| `TLS_V1_2_2019` |  |
| `TLS_V1_2_2021` |  |
| `TLS_V1_2_2025` |  |
| `TLS_V1_3_2025` |  |

## Referenced by

- [`DistributionProps`](/v2/docs/aws-cdk-lib.aws_cloudfront.DistributionProps).minimumProtocolVersion
- [`ViewerCertificateOptions`](/v2/docs/aws-cdk-lib.aws_cloudfront.ViewerCertificateOptions).securityPolicy