Using the Amazon unified command line interface:

• For configuring Origin SSL protocols first save locally the current distribution config:
  aws cloudfront get-distribution-config –id <application_cfn_distribution_id> –query “DistributionConfig” > /tmp/cf-distribution.json
• Edit and replace “OriginSslProtocols” element in /tmp/cf-distribution.json with the below section:
  “OriginSslProtocols”: {
  “Items”: [
  “TLSv1.1”,
  “TLSv1.2”
  ],
  “Quantity”: 2
  },
• Retrieve the current ETag of your CloudFront distribution:
  aws cloudfront get-distribution-config –id <application_cfn_distribution_id> –query “ETag”
• Update the CloudFront distribution using the edited config and the above Etag:
  aws cloudfront update-distribution –id <application_cfn_distribution_id> –distribution-config file:///tmp/cf-distribution.json –if-match <application_cfn_distribution_etag>

References:

1. https://aws.amazon.com/about-aws/whats-new/2016/01/amazon-cloudfront-adds-new-origin-security-features/
2. http://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution.html
3. http://docs.aws.amazon.com/cli/latest/reference/cloudfront/update-distribution.html