Security policy for HTTP APIs - Amazon API Gateway

Security policy for HTTP APIs

API Gateway enforces a security policy of TLS_1_2 for all HTTP API endpoints.

A security policy is a predefined combination of minimum TLS version and cipher suites offered by Amazon API Gateway. The TLS protocol addresses network security problems such as tampering and eavesdropping between a client and server. When your clients establish a TLS handshake to your API through the custom domain, the security policy enforces the TLS version and cipher suite options your clients can choose to use. This security policy accepts TLS 1.2 and TLS 1.3 traffic and rejects TLS 1.0 traffic.

Supported TLS protocols and ciphers for HTTP APIs

The following table describes the supported TLS protocols and ciphers for HTTP APIs.

Security policy TLS_1_2
TLS protocols

TLSv1.3

TLSv1.2

TLS ciphers

TLS-AES-128-GCM-SHA256

TLS-AES-256-GCM-SHA384

TLS-CHACHA20-POLY1305-SHA256

ECDHE-ECDSA-AES128-GCM-SHA256

ECDHE-RSA-AES128-GCM-SHA256

ECDHE-ECDSA-AES128-SHA256

ECDHE-RSA-AES128-SHA256

ECDHE-ECDSA-AES256-GCM-SHA384

ECDHE-RSA-AES256-GCM-SHA384

ECDHE-ECDSA-AES256-SHA384

ECDHE-RSA-AES256-SHA384

AES128-GCM-SHA256

AES128-SHA256

AES256-GCM-SHA384

AES256-SHA256

OpenSSL and RFC cipher names

OpenSSL and IETF RFC 5246 use different names for the same ciphers. For a list of the cipher names, see OpenSSL and RFC cipher names.

Information about REST APIs and WebSocket APIs

For more information about REST APIs and WebSocket APIs, see Choosing a security policy for your custom domain in API Gateway and Security policy for WebSocket APIs.