API Gateway custom domain TLS minimum version below 1.2

Severity: Medium
Service: API Gateway
Check ID: APIGW_CUSTOM_DOMAIN_WEAK_TLS

What this check finds

This API Gateway custom domain is configured with a TLS security policy below TLS 1.2. Older TLS versions are vulnerable to known protocol attacks.

Passing looks like: API Gateway custom domain enforces TLS 1.2+.

How to fix it

Update the domain security policy to TLS_1_2.

AWS CLI

aws apigateway update-domain-name --domain-name DOMAIN --patch-operations op=replace,path=/securityPolicy,value=TLS_1_2

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

API Gateway → Custom domain names → Edit.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to API Gateway custom domain TLS minimum version below 1.2
Framework	Controls
PCI-DSS v4.0.1	4.2 PAN is protected with strong cryptography during transmission over open, public networks
NIST SP 800-53 Rev5 (Moderate)	SC-8 Transmission Confidentiality and Integrity SC-23 Session Authenticity
NIST Cybersecurity Framework 2.0	PR.DS-02 Data-in-transit is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More API Gateway checks

All API Gateway checks