# Transport security in Amazon IoT Core TLS (Transport Layer Security) is a cryptographic protocol that is designed for secure communication over a computer network. The Amazon IoT Core Device Gateway requires customers to encrypt all communication while in-transit by using TLS for connections from devices to the Gateway. TLS is used to achieve confidentiality of the application protocols (MQTT, HTTP, and WebSocket) supported by Amazon IoT Core. TLS support is available in a number of programming languages and operating systems. Data within Amazon is encrypted by the specific Amazon service. For more information about data encryption on other Amazon services, see the security documentation for that service. **Topics** + [ ## TLS protocols ](#tls-ssl-policy) + [ ## Security policies ](#tls-policy-table) + [ ## Important notes for transport security in Amazon IoT Core ](#tls-ssl-core) + [ ## Transport security for LoRaWAN wireless devices ](#tls-lorawan) + [ ## Connection security ](#connection-security-bjs) ## TLS protocols Amazon IoT Core supports the following versions of the TLS protocol: + TLS 1.3 + TLS 1.2 ## Security policies **Note** This feature is not available in China. A security policy is a combination of TLS protocols and their ciphers that determine which protocols and ciphers are supported during TLS negotiations between a client and a server. You can configure your devices to use predefined security policies based on your needs. Note that Amazon IoT Core doesn't support custom security policies. You can choose one of the predefined security policies for your devices when connecting them to Amazon IoT Core. The names of the most recent predefined security policies in Amazon IoT Core include version information based on the year and month that they were released. The default predefined security policy is `IoTSecurityPolicy_TLS13_1_2_2022_10`. To specify a security policy, you can use the Amazon IoT console or the Amazon CLI. For more information, see [Configuring TLS settings in domain configurations](iot-endpoints-tls-config.md). The following table describes the most recent predefined security policies that Amazon IoT Core supports. The `IotSecurityPolicy_` has been removed from policy names in the heading row so that they fit. | **Security policy** | TLS13\$11\$13\$12022\$110 | TLS13\$11\$12\$12022\$110 | TLS12\$11\$12\$12022\$110 | TLS12\$11\$10\$12016\$101\$1 | TLS12\$11\$10\$12015\$101\$1 | | --- | --- | --- | --- | --- | --- | | TCP Port | 443/8443/8883 | 443/8443/8883 | 443/8443/8883 | 443 | 8443/8883 | 443 | 8443/8883 | | TLS Protocols | | TLS 1.2 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | TLS 1.3 | ✓ | ✓ | | | | | | | TLS Ciphers | | TLS\$1AES\$1128\$1GCM\$1SHA256 | ✓ | ✓ | | | | | | | TLS\$1AES\$1256\$1GCM\$1SHA384 | ✓ | ✓ | | | | | | | TLS\$1CHACHA20\$1POLY1305\$1SHA256 | ✓ | ✓ | | | | | | | ECDHE-RSA-AES128-GCM-SHA256 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-RSA-AES128-SHA256 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-RSA-AES128-SHA | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-RSA-AES256-GCM-SHA384 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-RSA-AES256-SHA384 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-RSA-AES256-SHA | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | AES128-GCM-SHA256 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | AES128-SHA256 | | ✓ | ✓ | ✓ | | ✓ | ✓ | | AES128-SHA | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | AES256-GCM-SHA384 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | AES256-SHA256 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | AES256-SHA | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | DHE-RSA-AES256-SHA | | | | | | ✓ | ✓ | | ECDHE-ECDSA-AES128-GCM-SHA256 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-ECDSA-AES128-SHA256 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-ECDSA-AES128-SHA | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-ECDSA-AES256-GCM-SHA384 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-ECDSA-AES256-SHA384 | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | ECDHE-ECDSA-AES256-SHA | | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | **Note** `TLS12_1_0_2016_01` is only available in the following Amazon Web Services Regions: ap-east-1, ap-northeast-2, ap-south-1, ap-southeast-2, ca-central-1, cn-north-1, cn-northwest-1, eu-north-1, eu-west-2, eu-west-3, me-south-1, sa-east-1, us-east-2, us-gov-west-1, us-gov-west-2, us-west-1. `TLS12_1_0_2015_01` is only available in the following Amazon Web Services Regions: ap-northeast-1, ap-southeast-1, eu-central-1, eu-west-1, us-east-1, us-west-2. ## Important notes for transport security in Amazon IoT Core For devices that connect to Amazon IoT Core using [MQTT](https://docs.amazonaws.cn//iot/latest/developerguide/mqtt.html), TLS encrypts the connection between the devices and the broker, and Amazon IoT Core uses TLS client authentication to identify devices. For more information, see [Client authentication](https://docs.amazonaws.cn//iot/latest/developerguide/client-authentication.html). For devices that connect to Amazon IoT Core using [HTTP](https://docs.amazonaws.cn//iot/latest/developerguide/http.html), TLS encrypts the connection between the devices and the broker, and authentication is delegated to Amazon Signature Version 4. For more information, see [Signing requests with Signature Version 4](https://docs.amazonaws.cn//general/latest/gr/create-signed-request.html) in the *Amazon General Reference*. When you connect devices to Amazon IoT Core, sending the [Server Name Indication (SNI) extension](https://tools.ietf.org/html/rfc3546#section-3.1) is not required but highly recommended. To use features such as [multi-account registration](https://docs.amazonaws.cn//iot/latest/developerguide/x509-client-certs.html#multiple-account-cert), [custom domains](https://docs.amazonaws.cn//iot/latest/developerguide/iot-custom-endpoints-configurable-custom.html), [VPC endpoints](https://docs.amazonaws.cn//iot/latest/developerguide/IoTCore-VPC.html), and [configured TLS policies](https://docs.amazonaws.cn//iot/latest/developerguide/iot-endpoints-tls-config.html), you must use the SNI extension and provide the complete endpoint address in the `host_name` field. The `host_name` field must contain the endpoint you are calling. That endpoint must be one of the following: + The `endpointAddress` returned by `aws iot [describe-endpoint](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iot/describe-endpoint.html) --endpoint-type iot:Data-ATS` + The `domainName` returned by `aws iot [describe-domain-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iot/describe-domain-configuration.html) –-domain-configuration-name "domain_configuration_name"` Connections attempted by devices with the incorrect or invalid `host_name` value will fail. Amazon IoT Core will log failures to CloudWatch for the authentication type of [Custom Authentication](https://docs.amazonaws.cn//iot/latest/developerguide/custom-authentication.html). Amazon IoT Core doesn't support the [SessionTicket TLS extension](https://www.ietf.org/rfc/rfc5077.txt). ## Transport security for LoRaWAN wireless devices LoRaWAN devices follow the security practices described in [LoRaWAN ™ SECURITY: A White Paper Prepared for the LoRa Alliance™ by Gemalto, Actility, and Semtech](https://lora-alliance.org/sites/default/files/2019-05/lorawan_security_whitepaper.pdf). For more information about transport security with LoRaWAN devices, see [LoRaWAN data and transport security](https://docs.amazonaws.cn/iot-wireless/latest/developerguide/iot-lorawan-security.html). ## Connection security Amazon IoT Core message broker and Device Shadow services rely on communication using encryption and [TLS 1.2](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2) and [TLS 1.3](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3). Amazon IoT Core supports the following TLS cipher suites: + ECDHE-ECDSA-AES128-GCM-SHA256 (recommended) + ECDHE-RSA-AES128-GCM-SHA256 (recommended) + ECDHE-ECDSA-AES128-SHA256 + ECDHE-RSA-AES128-SHA256 + ECDHE-ECDSA-AES128-SHA + ECDHE-RSA-AES128-SHA + ECDHE-ECDSA-AES256-GCM-SHA384 + ECDHE-RSA-AES256-GCM-SHA384 + ECDHE-ECDSA-AES256-SHA384 + ECDHE-RSA-AES256-SHA384 + ECDHE-RSA-AES256-SHA + ECDHE-ECDSA-AES256-SHA + AES128-GCM-SHA256 + AES128-SHA256 + AES128-SHA + AES256-GCM-SHA384 + AES256-SHA256 + AES256-SHA