Enforcing a minimum TLS version

To add increased security when communicating with AWS services, you must configure your client to use TLS 1.2 or later. To work with AWS services, the underlying Go runtime must support a minimum version of TLS 1.2, but TLS 1.3 is recommended.

TLS 1.3 is the prerequisite to enable post-quantum cryptography, which might require additional actions or configurations. For more information, see Enabling hybrid post-quantum TLS in the AWS SDKs and Tools Reference Guide.

Setting the TLS version

In the AWS SDK for Go v2, you configure the minimum TLS version by providing a custom HTTP client whose transport specifies a tls.Config, which is documented on the Go package documentation website. For more information about customizing the HTTP client, see Customize the HTTP Client.

The following example builds an HTTP client that requires a minimum of TLS 1.2 and passes it to config.LoadDefaultConfig.

import (
    "context"
    "crypto/tls"
    "log"
    "net/http"

    awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
    "github.com/aws/aws-sdk-go-v2/config"
)

// ...

httpClient := awshttp.NewBuildableClient().WithTransportOptions(func(tr *http.Transport) {
    tr.TLSClientConfig = &tls.Config{
        MinVersion: tls.VersionTLS12,
    }
})

cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithHTTPClient(httpClient))
if err != nil {
    log.Fatalf("failed to load configuration, %v", err)
}

To require TLS 1.3, set MinVersion to tls.VersionTLS13.