AWS cli medium security documentation change

Service: cli · 2025-11-22 · Security-related medium

File: cli/latest/reference/apigateway/create-rest-api.md

Summary

Added security policy configuration and endpoint access mode for REST APIs

Security assessment

Introduces TLS 1.3 security policies and endpoint access controls (BASIC/STRICT modes) for API Gateway REST APIs. These changes enable stronger cryptographic protections and network access controls, directly impacting API security posture.

Diff

diff --git a/cli/latest/reference/apigateway/create-rest-api.md b/cli/latest/reference/apigateway/create-rest-api.md
index f9899bae7..122139b8a 100644
--- a//cli/latest/reference/apigateway/create-rest-api.md
+++ b//cli/latest/reference/apigateway/create-rest-api.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.39 Command Reference](../../index.html) »
+  * [AWS CLI 2.32.3 Command Reference](../../index.html) »
@@ -77,0 +78,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/apigat
+    [--security-policy <value>]
+    [--endpoint-access-mode <value>]
@@ -223,0 +226,31 @@ JSON Syntax:
+`--security-policy` (string)
+
+> The Transport Layer Security (TLS) version + cipher suite for this RestApi.
+> 
+> Possible values:
+> 
+>   * `TLS_1_0`
+>   * `TLS_1_2`
+>   * `SecurityPolicy_TLS13_1_3_2025_09`
+>   * `SecurityPolicy_TLS13_1_3_FIPS_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_FIPS_PQ_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_PQ_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_2021_06`
+>   * `SecurityPolicy_TLS13_2025_EDGE`
+>   * `SecurityPolicy_TLS12_PFS_2025_EDGE`
+>   * `SecurityPolicy_TLS12_2018_EDGE`
+> 
+
+
+`--endpoint-access-mode` (string)
+
+> The endpoint access mode of the RestApi. Only available for RestApis that use security policies that start with `SecurityPolicy_` .
+> 
+> Possible values:
+> 
+>   * `BASIC`
+>   * `STRICT`
+> 
+
+
@@ -454,0 +488,48 @@ rootResourceId -> (string)
+securityPolicy -> (string)
+
+> The Transport Layer Security (TLS) version + cipher suite for this RestApi.
+> 
+> Possible values:
+> 
+>   * `TLS_1_0`
+>   * `TLS_1_2`
+>   * `SecurityPolicy_TLS13_1_3_2025_09`
+>   * `SecurityPolicy_TLS13_1_3_FIPS_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_FIPS_PQ_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_PQ_2025_09`
+>   * `SecurityPolicy_TLS13_1_2_2021_06`
+>   * `SecurityPolicy_TLS13_2025_EDGE`
+>   * `SecurityPolicy_TLS12_PFS_2025_EDGE`
+>   * `SecurityPolicy_TLS12_2018_EDGE`
+> 
+
+
+endpointAccessMode -> (string)
+
+> The endpoint access mode of the RestApi.
+> 
+> Possible values:
+> 
+>   * `BASIC`
+>   * `STRICT`
+> 
+
+
+apiStatus -> (string)
+
+> The ApiStatus of the RestApi.
+> 
+> Possible values:
+> 
+>   * `UPDATING`
+>   * `AVAILABLE`
+>   * `PENDING`
+>   * `FAILED`
+> 
+
+
+apiStatusMessage -> (string)
+
+> The status message of the RestApi. When the status message is `UPDATING` you can still invoke it.
+
@@ -465 +546 @@ rootResourceId -> (string)
-  * [AWS CLI 2.31.39 Command Reference](../../index.html) »
+  * [AWS CLI 2.32.3 Command Reference](../../index.html) »