feat(apigateway): DomainName supports SecurityPolicy #6374
Conversation
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
|
||
| /** | ||
| * The Transport Layer Security (TLS) version + cipher suite for this domain name. | ||
| * @default undefined. This field is optional in AWS::ApiGateway::DomainName SecurityPolicy |
There was a problem hiding this comment.
What does CloudFormation default to? We should document that as the default here.
You can identify this by not setting this in CloudFormation, deploying the stack and calling the get-domain-name from the CLI.
I'm hoping it'll be TLS 1.2; if not, I think the CDK should pick that as the default.
There was a problem hiding this comment.
That's actually the reason I looked into this; ApiGateway/CloudFormation defaults this to TLS 1.0. I'm in favor of defaulting it to TLS 1.2, but would that be a potentially breaking change since it restricts the allowed ciphers?
There was a problem hiding this comment.
Actually, that's a very good point. We should keep it as TLS 1.0 then.
| TLS_1_0 = 'TLS_1_0', | ||
| TLS_1_2 = 'TLS_1_2' |
There was a problem hiding this comment.
I would rather avoid the awslint exclusions in the package.json.
| TLS_1_0 = 'TLS_1_0', | |
| TLS_1_2 = 'TLS_1_2' | |
| /** Cipher suite TLS 1.0 */ | |
| TLS_1_0 = 'TLS_1_0', | |
| /** Cipher suite TLS 1.2 */ | |
| TLS_1_2 = 'TLS_1_2' |
There was a problem hiding this comment.
TLS 1.0 is EOL on the march 31, 2020 ( ie, in 11 days) - so we should use 1.2 ?
| import { EndpointType, IRestApi } from './restapi'; | ||
|
|
||
| /** | ||
| * The minimum version of the SSL protocol that you want Api Gateway to use for HTTPS connections. |
There was a problem hiding this comment.
| * The minimum version of the SSL protocol that you want Api Gateway to use for HTTPS connections. | |
| * The minimum version of the SSL protocol that you want API Gateway to use for HTTPS connections. |
| @@ -65,6 +65,41 @@ export = { | |||
| test.done(); | |||
| }, | |||
|
|
|||
| 'accepts different security policies'(test: Test) { | |||
There was a problem hiding this comment.
Can you add a 3rd verification, that when left unspecified, the value is absent in the CF template. Use ABSENT to do this.
…st for absent securityPolicy
mergify
bot
dismissed
nija-at’s stale review
Pull request has been modified.
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
* Pass securityPolicy from API Gateway DomainName to cfnDomainName * Update ApiGateway README with example securityPolicy * DomainName: Add documentation for SecurityPolicy TSL versions, add test for absent securityPolicy * fix tsdoc @default Co-authored-by: Void-Concept <[email protected]> Co-authored-by: Niranjan Jayakar <[email protected]> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Passes SecurityPolicy prop from DomainName to CfnDomainName. Added new enum with the 2 current valid values for SecurityPolicy.
Closes #3862