Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Security policy for WebSocket APIs in API Gateway

API Gateway enforces a security policy of TLS_1_2 for all WebSocket API endpoints.

A security policy is a predefined combination of minimum TLS version and cipher suites offered by Amazon API Gateway. The TLS protocol addresses network security problems such as tampering and eavesdropping between a client and server. When your clients establish a TLS handshake to your API through the custom domain, the security policy enforces the TLS version and cipher suite options your clients can choose to use. This security policy accepts TLS 1.2 and TLS 1.3 traffic and rejects TLS 1.0 traffic.

Supported TLS protocols and ciphers for WebSocket APIs

The following table describes the supported TLS protocols and ciphers for WebSocket APIs.

OpenSSL and RFC cipher names

OpenSSL and IETF RFC 5246, use different names for the same ciphers. For a list of the cipher names, see OpenSSL and RFC cipher names.

Information about REST APIs and HTTP APIs

For more information about REST APIs and HTTP APIs, see Choose a security policy for your REST API custom domain in API Gateway and Security policy for HTTP APIs in API Gateway.