The current CloudFront implementation has no way as far as I can tell to set the Security Policy of the distribution (called MinimumProtocolVersion inside CloudFormation). This looks like it would fall under the AliasConfiguration object.

Docs can be seen here:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-minimumprotocolversion