AWS Security ChangesHomeSearch

AWS cli: OpenSearch update-domain-config: allow FIPS post-quantum TLS policy

Service: cli · 2026-10-20 · Documentation medium

File: cli/latest/reference/opensearch/update-domain-config.md · Type: encryption

Summary

Adds Policy-Min-TLS-1-2-FIPS-PQ-2026-10 to the TLSSecurityPolicy enum in the JSON syntax and to the documented policy list for update-domain-config, plus CLI version bump.

Security assessment

The change makes a new FIPS/post-quantum TLS security policy selectable via update-domain-config, directly affecting in-transit encryption configuration; it documents a hardening option rather than fixing a specific flaw.

Evidence

+      "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"|"Policy-Min-TLS-1-2-2019-07"|"Policy-Min-TLS-1-2-PFS-2023-10"|"Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08"|"Policy-Min-TLS-1-2-FIPS-PQ-2026-10",

Diff

diff --git a/cli/latest/reference/opensearch/update-domain-config.md b/cli/latest/reference/opensearch/update-domain-config.md
index 355f882..a45c165 100644
--- a//cli/latest/reference/opensearch/update-domain-config.md
+++ b//cli/latest/reference/opensearch/update-domain-config.md
@@ -15 +15 @@
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
@@ -944,0 +945 @@ JSON Syntax:
+>>   * **Policy-Min-TLS-1-2-FIPS-PQ-2026-10:** TLS security policy that supports TLS version 1.2 to TLS version 1.3 with FIPS and post-quantum cipher suites
@@ -953,0 +955 @@ JSON Syntax:
+>>   * `Policy-Min-TLS-1-2-FIPS-PQ-2026-10`
@@ -996 +998 @@ JSON Syntax:
-      "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"|"Policy-Min-TLS-1-2-2019-07"|"Policy-Min-TLS-1-2-PFS-2023-10"|"Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08",
+      "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"|"Policy-Min-TLS-1-2-2019-07"|"Policy-Min-TLS-1-2-PFS-2023-10"|"Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08"|"Policy-Min-TLS-1-2-FIPS-PQ-2026-10",
@@ -3034,0 +3037 @@ DomainConfig -> (structure)
+>>>>   * **Policy-Min-TLS-1-2-FIPS-PQ-2026-10:** TLS security policy that supports TLS version 1.2 to TLS version 1.3 with FIPS and post-quantum cipher suites
@@ -3043,0 +3047 @@ DomainConfig -> (structure)
+>>>>   * `Policy-Min-TLS-1-2-FIPS-PQ-2026-10`
@@ -4215 +4219 @@ DryRunProgressStatus -> (structure)
-  * [AWS CLI 2.38.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.2 Command Reference](../../index.html) »