Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Security policy for HTTP APIs

API Gateway enforces a security policy of TLS_1_2 for all HTTP API endpoints.

A security policy is a predefined combination of minimum TLS version and cipher suites offered by Amazon API Gateway. The TLS protocol addresses network security problems such as tampering and eavesdropping between a client and server. When your clients establish a TLS handshake to your API through the custom domain, the security policy enforces the TLS version and cipher suite options your clients can choose to use. This security policy accepts TLS 1.2 and TLS 1.3 traffic and rejects TLS 1.0 traffic.

Supported TLS protocols and ciphers for HTTP APIs

The following table describes the supported TLS protocols and ciphers for HTTP APIs.

OpenSSL and RFC cipher names

OpenSSL and IETF RFC 5246 use different names for the same ciphers. For a list of the cipher names, see OpenSSL and RFC cipher names.

Information about REST APIs and WebSocket APIs

For more information about REST APIs and WebSocket APIs, see Choosing a security policy for your custom domain in API Gateway and Security policy for WebSocket APIs.