Enhancing API security with Amazon API Gateway TLS security policies

This article introduces enhanced TLS security policies for Amazon API Gateway, enabling granular control over TLS configuration to meet compliance standards like PCI DSS, FIPS, and Open Banking.

• Configure TLS behavior on all REST API endpoint types: Regional, edge-optimized, and private
• Choose from predefined enhanced security policies enforcing minimum TLS versions and cipher suites
• Support for TLS 1.3-only policies, hardened TLS 1.2 without CBC ciphers, and post-quantum cryptography
• Two endpoint access modes: BASIC (standard behavior) and STRICT (additional validation checks)
• Apply security policies during API creation or update existing APIs with BASIC-to-STRICT migration path
• Monitor TLS usage via access logs variables: $context.tlsVersion and $context.cipherSuite
• Policy updates take up to 15 minutes to propagate; API remains available during changes

Enhanced TLS security policies provide direct control over secure client connections without operational complexity, helping APIs align with evolving security and compliance requirements.