feat(opensearchservice): TLS security policy for TLS 1.3 and perfect forward secrecy#28583
feat(opensearchservice): TLS security policy for TLS 1.3 and perfect forward secrecy#28583mergify[bot] merged 4 commits intoaws:mainfrom
Conversation
aws-cdk-automation
left a comment
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
|
Exemption Request: This PR just adds the version as enum property. |
lpizzinidev
left a comment
There was a problem hiding this comment.
Thanks 👍 Just a minor adjustment on naming in my opinion.
| TLS_1_2 = 'Policy-Min-TLS-1-2-2019-07' | ||
| TLS_1_2 = 'Policy-Min-TLS-1-2-2019-07', | ||
| /** Cipher suite TLS 1.2 to 1.3 with perfect forward secrecy (PFS) */ | ||
| TLS_1_2_PFS = 'Policy-Min-TLS-1-2-PFS-2023-10', |
There was a problem hiding this comment.
| TLS_1_2_PFS = 'Policy-Min-TLS-1-2-PFS-2023-10', | |
| TLS_1_3 = 'Policy-Min-TLS-1-2-PFS-2023-10', |
I think it's clearer if we specify v1.3.
There was a problem hiding this comment.
Thanks for your review.
I thought about that too, but do we not have to think about the future appearance of a new option that only allows TLS 1.3 (does not include 1.2)?
Also, there is hesitation in key names that are not in line with the value, what do you think?
lpizzinidev
left a comment
There was a problem hiding this comment.
do we not have to think about the future appearance of a new option that only allows TLS 1.3
Good point, thanks for the follow-up 👍
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
This PR supports new TLS security policy 'Policy-Min-TLS-1-2-PFS-2023-10' for TLS 1.3 and perfect forward secrecy.
The description from CLI reference:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license