Amazon CloudFront allows you to choose a security policy with minimum TLS v1.1, v1.1, and the security ciphers for the viewer connections!

Amazon Web Service introduced further improved security for web applications on Amazon CloudFront by choosing a pre-defined security policy that administers TLS version 1.1 or 1.2 as the minimum protocol version. Amazon CloudFront will automatically choose the cipher suite for the selected security policy that is used to encrypt the content before returning it to the viewers over the HTTPS. With this new feature, you can choose the security policy that administers the TLS version 1.1 and weak ciphers such as 3DES and RC4 will automatically be eliminated. This Feature is now available when you utilize custom SSL certificates to deliver HTTPS request using the SNI.