I'm using a tool to do security checks and this tool marked the following ciphers as weak:
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003C)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xC027)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xC028)
I'm using the latest CloudFront Security Policy which is TLSv1.2_2018 and the Minimum Origin SSL Protocol set to TLSv1.2.
But even with these settings the weak ciphers is still allowed.
Is it possible to disable some specific ciphers on CloudFront?
AWS doesn't allow customers to choose individual ciphers for Amazon CloudFront. Instead it allows customers to choose between different security policies. The available security policies are listed in their documentation. As of now TLSv1.2_2018 is the latest security policy they offer and also the one they recommend customers to use. This policy includes the three ciphers you'd like to disable, so there is currently no way to use TLS with AWS CloudFront without these ciphers.
Aside from the security policies offered to customers right now, AWS has already defined newer security policies for use with Amazon CloudFront in s2n, the TLS-implementation they use for most of their public facing products.
Looking into the source code of s2n reveals the following additional security policies and the ciphers they support:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
The latest security policy (TLSv1.2_2020) doesn't include the three ciphers you want to disable anymore, so whenever AWS decides to make this security policy available to its customers, you'll be able to disable the ciphers in question.