AWS cli: Add FIPS post-quantum TLS security policy option to OpenSearch create-domain

Service: cli · 2026-10-20 · Documentation high

File: cli/latest/reference/opensearch/create-domain.md · Type: encryption

Summary

Adds the new `Policy-Min-TLS-1-2-FIPS-PQ-2026-10` TLSSecurityPolicy value (TLS 1.2-1.3 with FIPS and post-quantum cipher suites) to the create-domain input and DomainStatus output documentation.

Security assessment

The change documents a new transport-encryption policy option that enforces TLS 1.2+ with FIPS-validated and post-quantum cipher suites, strengthening in-transit encryption for OpenSearch domains; it is a new capability rather than a fix for a specific vulnerability.

Evidence

+>>   * **Policy-Min-TLS-1-2-FIPS-PQ-2026-10:** TLS security policy that supports TLS version 1.2 to TLS version 1.3 with FIPS and post-quantum cipher suites

Diff

diff --git a/cli/latest/reference/opensearch/create-domain.md b/cli/latest/reference/opensearch/create-domain.md
index 7678225..f6320f3 100644
--- a//cli/latest/reference/opensearch/create-domain.md
+++ b//cli/latest/reference/opensearch/create-domain.md
@@ -15 +15 @@
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
@@ -978,0 +979 @@ JSON Syntax:
+>>   * **Policy-Min-TLS-1-2-FIPS-PQ-2026-10:** TLS security policy that supports TLS version 1.2 to TLS version 1.3 with FIPS and post-quantum cipher suites
@@ -987,0 +989 @@ JSON Syntax:
+>>   * `Policy-Min-TLS-1-2-FIPS-PQ-2026-10`
@@ -1030 +1032 @@ JSON Syntax:
-      "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"|"Policy-Min-TLS-1-2-2019-07"|"Policy-Min-TLS-1-2-PFS-2023-10"|"Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08",
+      "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"|"Policy-Min-TLS-1-2-2019-07"|"Policy-Min-TLS-1-2-PFS-2023-10"|"Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08"|"Policy-Min-TLS-1-2-FIPS-PQ-2026-10",
@@ -2660,0 +2663 @@ DomainStatus -> (structure)
+>>>   * **Policy-Min-TLS-1-2-FIPS-PQ-2026-10:** TLS security policy that supports TLS version 1.2 to TLS version 1.3 with FIPS and post-quantum cipher suites
@@ -2669,0 +2673 @@ DomainStatus -> (structure)
+>>>   * `Policy-Min-TLS-1-2-FIPS-PQ-2026-10`
@@ -3236 +3240 @@ DomainStatus -> (structure)
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »