AWS config high security documentation change
Summary
Expanded TLS security policy compliance rules to include custom 'allowedSecurityPolicies' parameter checks
Security assessment
The change strengthens TLS enforcement by introducing configurable security policy requirements. This directly addresses security weaknesses by preventing TLS downgrades and allowing custom policy enforcement, evidenced by the new parameter-based compliance checks.
Diff
diff --git a/config/latest/developerguide/apigateway-domain-name-tls-check.md b/config/latest/developerguide/apigateway-domain-name-tls-check.md index d8ee9bb4e..b56a85e4b 100644 --- a//config/latest/developerguide/apigateway-domain-name-tls-check.md +++ b//config/latest/developerguide/apigateway-domain-name-tls-check.md @@ -11 +11 @@ AWS CloudFormation template -Checks if Amazon API Gateway domain names are configured with TLS 1.2 or higher. The rule is NON_COMPLIANT if configuration.SecurityPolicy is 'TLS_1_0'. +Checks if Amazon API Gateway domain names are configured with TLS 1.2 or higher. The rule is NON_COMPLIANT if configuration.SecurityPolicy is 'TLS_1_0', or if the '`allowedSecurityPolicies`' parameter is provided and the security policy does not match.