diff --git a/packages/@aws-cdk/aws-apigateway/lib/domain-name.ts b/packages/@aws-cdk/aws-apigateway/lib/domain-name.ts
index 13afc9d6bc1f9..ed3904dcf459c 100644
--- a/packages/@aws-cdk/aws-apigateway/lib/domain-name.ts
+++ b/packages/@aws-cdk/aws-apigateway/lib/domain-name.ts
@@ -5,10 +5,12 @@ import { BasePathMapping, BasePathMappingOptions } from './base-path-mapping';
 import { EndpointType, IRestApi } from './restapi';
 
 /**
- * The minimum version of the SSL protocol that you want Api Gateway to use for HTTPS connections.
+ * The minimum version of the SSL protocol that you want API Gateway to use for HTTPS connections.
  */
 export enum SecurityPolicy {
+  /** Cipher suite TLS 1.0 */
   TLS_1_0 = 'TLS_1_0',
+  /** Cipher suite TLS 1.2 */
   TLS_1_2 = 'TLS_1_2'
 }
 
diff --git a/packages/@aws-cdk/aws-apigateway/package.json b/packages/@aws-cdk/aws-apigateway/package.json
index 874853ece1f85..e61d05f3c3e37 100644
--- a/packages/@aws-cdk/aws-apigateway/package.json
+++ b/packages/@aws-cdk/aws-apigateway/package.json
@@ -174,8 +174,6 @@
       "docs-public-apis:@aws-cdk/aws-apigateway.Stage",
       "docs-public-apis:@aws-cdk/aws-apigateway.Stage.restApi",
       "docs-public-apis:@aws-cdk/aws-apigateway.Stage.stageName",
-      "docs-public-apis:@aws-cdk/aws-apigateway.SecurityPolicy.TLS_1_0",
-      "docs-public-apis:@aws-cdk/aws-apigateway.SecurityPolicy.TLS_1_2",
       "docs-public-apis:@aws-cdk/aws-apigateway.UsagePlan",
       "docs-public-apis:@aws-cdk/aws-apigateway.UsagePlan.usagePlanId",
       "docs-public-apis:@aws-cdk/aws-apigateway.VpcLink.addTargets",
diff --git a/packages/@aws-cdk/aws-apigateway/test/test.domains.ts b/packages/@aws-cdk/aws-apigateway/test/test.domains.ts
index c41623611f56c..fd7d3e7e85c2a 100644
--- a/packages/@aws-cdk/aws-apigateway/test/test.domains.ts
+++ b/packages/@aws-cdk/aws-apigateway/test/test.domains.ts
@@ -1,5 +1,5 @@
 // tslint:disable:object-literal-key-quotes
-import { expect, haveResource } from '@aws-cdk/assert';
+import { ABSENT, expect, haveResource } from '@aws-cdk/assert';
 import * as acm from '@aws-cdk/aws-certificatemanager';
 import { Stack } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
@@ -83,6 +83,11 @@ export = {
       securityPolicy: apigw.SecurityPolicy.TLS_1_2
     });
 
+    new apigw.DomainName(stack, 'default-domain', {
+      domainName: 'default.example.com',
+      certificate: cert
+    });
+
     // THEN
     expect(stack).to(haveResource('AWS::ApiGateway::DomainName', {
       "DomainName": "old.example.com",
@@ -97,6 +102,13 @@ export = {
       "RegionalCertificateArn": { "Ref": "Cert5C9FAEC1" },
       "SecurityPolicy": "TLS_1_2"
     }));
+
+    expect(stack).to(haveResource('AWS::ApiGateway::DomainName', {
+      "DomainName": "default.example.com",
+      "EndpointConfiguration": { "Types": [ "REGIONAL" ] },
+      "RegionalCertificateArn": { "Ref": "Cert5C9FAEC1" },
+      "SecurityPolicy": ABSENT
+    }));
     test.done();
   },