The [SslPolicy](https://github.com/aws/aws-cdk/blob/1a28d632fc6d0c706d8f97e2558d621967af174a/packages/%40aws-cdk/aws-elasticloadbalancingv2/lib/shared/enums.ts#L99) enum is, well, an enum, and the [place it's used](https://github.com/aws/aws-cdk/blob/1a28d632fc6d0c706d8f97e2558d621967af174a/packages/%40aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-listener.ts#L68) expects an enum, but the underlying type in CloudFormation is [a string](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-listener.html). This means that as time has gone on, [new recommended cipher suites](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html) have popped up.
The SslPolicy enum is, well, an enum, and the place it's used expects an enum, but the underlying type in CloudFormation is a string.
This means that as time has gone on, new recommended cipher suites have popped up.