aws-cloudfront-tls-audit — both sides of the CloudFront edge in one report

CloudFront is the one place where a distribution looks finished and still terminates TLS the way 2014 wanted: a MinimumProtocolVersion of TLSv1 because that was the default in the wizard, a viewer protocol policy of allow-all so http:// keeps working forever, or the *.cloudfront.net default certificate on a distribution with a real CNAME pointed at it. This reads every distribution config once and reports the viewer and origin TLS weaknesses together.