Multiple recent AWS emails about TLS1.1 or older

Question

Hi All. I have had multiple emails recently from AWS with subject line “[ACTION REQUIRED] - Update your TLS connections to 1.2 to maintain AWS endpoint connectivity [AWS Account: 090759423501]”. The key part of the email seems to be

.....................

Please see the following for further details on the TLS 1.0 or TLS 1.1 connections detected from your account between February 25, 2023 and March 13, 2023 (the UserAgent may be truncated due to a limit in the number of characters that can be displayed):

............................

However, my reading of that is that it is a system call from a .net runtime and I’m not really sure what I can do about this.

Your assistance would be appreciated. I typically use AWS resources in two ways: 
a) scheduled or triggered Lambda calls built directly in the AWS interface or 
b) calls from c# .net programs coded in Visual Studio

I followed some links to literature that the AWS account manager gave me which suggested
1) Use the Cloud Trail section of CloudWatch to find log entries where TLS 1.0 or 1.1 was used - I tried this but could find no matching records when I ran the query
2) Check the general account health dashboard - I did this but no problems are reported there.

Can anyone suggest a course of action here?
Thanks
Richard Abbott

Answer

Hello Richard,

Thanks for reaching out.

The approach to follow is to use CloudTrail to find an event that uses TLS 1.0 or TLS1.1. You will get additional information such as SourceIp or the PrincipalID.
Here is a guidance on how you can use CloudTrail Lake: https://aws.amazon.com/blogs/mt/using-aws-cloudtrail-lake-to-identify-older-tls-connections-to-aws-service-endpoints/. You can use the pre-defined queries there to catch the TLS 1.0/1.1 events.

If this does not return any result, this could mean the workload is stopped or the issue was resolved. Your account manager can reach out internally as well for us to assist with more information so we can check more information for you.

For this specific entry without more details than this finding, you should follow Microsoft guidance to enable TLS 1.2 at the OS level and upgrade .Net dependencies.
Please find below a few links that will share lights on this:
* TLS 1.2 OS level settings https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client
* SDK for .Net versions: https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/enforcing-tls.html
* Enforcing TLS for AWS SDK for .NET: https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/enforcing-tls.html

Hope it helps,

Jon

Multiple recent AWS emails about TLS1.1 or older

Relevant content