AWS payment-cryptography documentation change
Summary
Updated PQ TLS implementation details for AWS CLI and corrected service name reference
Security assessment
This documents the availability of Post-Quantum TLS (security feature) in AWS CLI v2.34.54+ with specific OpenSSL requirements. While it enhances security documentation by providing quantum-resistant cryptography implementation details, there's no evidence of a specific security vulnerability being addressed.
Diff
diff --git a/payment-cryptography/latest/userguide/pqtls-details.md b/payment-cryptography/latest/userguide/pqtls-details.md index bb20b2e3d..9cd88400d 100644 --- a//payment-cryptography/latest/userguide/pqtls-details.md +++ b//payment-cryptography/latest/userguide/pqtls-details.md @@ -52 +52 @@ The AWS SDK for Rust distributes distinct packages (known as “crates” in the -You can determine the minimum version supporting PQ TLS for a particular service client by navigating to the relevant crates.io version URL (for example, AWS Payment Cryptography's is [here](https://crates.io/crates/aws-sdk-paymentcryptography/versions)) and finding the first version published after 29-Aug-25. Any service client version published after 29-Aug-25 will have PQ TLS enabled and preferred by default. +You can determine the minimum version supporting PQ TLS for a particular service client by navigating to the relevant crates.io version URL (for example, AWS Promotional Credit's is [here](https://crates.io/crates/aws-sdk-paymentcryptography/versions)) and finding the first version published after 29-Aug-25. Any service client version published after 29-Aug-25 will have PQ TLS enabled and preferred by default. @@ -82 +82 @@ You can also configure a Docker container to use OpenSSL 3.5 to enable PQ TLS on -PQ TLS support with the [AWS CLI installer](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) is coming soon. To enable immediately, you can use alternative installers for the AWS CLI, which varies by operating system, and can enable PQ TLS. +As of v2.34.54, the [AWS CLI installer](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) for Linux bundles OpenSSL 3.5.6, so PQ TLS is enabled and preferred by default for that and subsequent versions on Linux. AWS CLI users on Linux can enable PQ TLS by upgrading to AWS CLI v2.34.54 or later. @@ -86 +86 @@ For MacOS, install the AWS CLI via [Homebrew](https://brew.sh/) and ensure that -For Ubuntu or Debian Linux: ensure the Linux distribution you are using has OpenSSL 3.5+ installed as system OpenSSL. Then, install the AWS CLI using apt or [PyPI](https://pypi.org/project/awscliv2/). With these prerequisites, the AWS CLI vended by apt or PyPI will be configured to negotiate PQ-TLS. For step-by-step instructions to validate the installation, see [github repository](https://github.com/aws-samples/sample-post-quantum-tls-python/) and accompanying [blog post](https://aws.amazon.com/blogs/security/post-quantum-tls-in-python/). +If you cannot upgrade to AWS CLI v2.34.54 or later on Ubuntu or Debian Linux, ensure the Linux distribution you are using has OpenSSL 3.5+ installed as system OpenSSL. Then, install the AWS CLI using apt or [PyPI](https://pypi.org/project/awscliv2/). With these prerequisites, the AWS CLI vended by apt or PyPI will be configured to negotiate PQ-TLS. For step-by-step instructions to validate the installation, see [github repository](https://github.com/aws-samples/sample-post-quantum-tls-python/) and accompanying [blog post](https://aws.amazon.com/blogs/security/post-quantum-tls-in-python/).