The Amazon SDK for JavaScript v2 has reached end-of-support. We recommend that you migrate to [Amazon SDK for JavaScript v3](https://docs.amazonaws.cn//sdk-for-javascript/v3/developer-guide/). For additional details and information on how to migrate, please refer to this [announcement](https://amazonaws-china.com/blogs//developer/announcing-end-of-support-for-aws-sdk-for-javascript-v2/).

# Security for this Amazon Product or Service
Security

Cloud security at Amazon Web Services (Amazon) is the highest priority. As an Amazon customer, you benefit from a data center and network architecture that is built to meet the requirements of the most security-sensitive organizations. Security is a shared responsibility between Amazon and you. The [Shared Responsibility Model](http://www.amazonaws.cn/compliance/shared-responsibility-model/) describes this as Security of the Cloud and Security in the Cloud.

**Security of the Cloud** – Amazon is responsible for protecting the infrastructure that runs all of the services offered in the Amazon Cloud and providing you with services that you can use securely. Our security responsibility is the highest priority at Amazon, and the effectiveness of our security is regularly tested and verified by third-party auditors as part of the [Amazon Compliance Programs](http://www.amazonaws.cn/compliance/programs/).

**Security in the Cloud** – Your responsibility is determined by the Amazon service you are using, and other factors including the sensitivity of your data, your organization’s requirements, and applicable laws and regulations.

This Amazon product or service follows the [shared responsibility model](http://www.amazonaws.cn/compliance/shared-responsibility-model/) through the specific Amazon Web Services (Amazon) services it supports. For Amazon service security information, see the [Amazon service security documentation page](https://docs.amazonaws.cn/security/?id=docs_gateway#aws-security) and [Amazon services that are in scope of Amazon compliance efforts by compliance program](http://www.amazonaws.cn/compliance/services-in-scope/).

**Topics**
+ [Data protection](data-protection.md)
+ [Identity and Access Management](security-iam.md)
+ [Compliance Validation](compliance-validation.md)
+ [Resilience](disaster-recovery-resiliency.md)
+ [Infrastructure Security](infrastructure-security.md)
+ [

# Enforcing a minimum version of TLS
](enforcing-tls.md)

# Data protection in this Amazon product or service
Data protection

The Amazon [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) applies to data protection in this Amazon product or service. As described in this model, Amazon is responsible for protecting the global infrastructure that runs all of the Amazon Web Services Cloud. You are responsible for maintaining control over your content that is hosted on this infrastructure. You are also responsible for the security configuration and management tasks for the Amazon Web Services services that you use. For more information about data privacy, see the [Data Privacy FAQ](https://www.amazonaws.cn/compliance/data-privacy-faq/).

For data protection purposes, we recommend that you protect Amazon Web Services account credentials and set up individual users with Amazon IAM Identity Center or Amazon Identity and Access Management (IAM). That way, each user is given only the permissions necessary to fulfill their job duties. We also recommend that you secure your data in the following ways:
+ Use multi-factor authentication (MFA) with each account.
+ Use SSL/TLS to communicate with Amazon resources. We require TLS 1.2 and recommend TLS 1.3.
+ Set up API and user activity logging with Amazon CloudTrail. For information about using CloudTrail trails to capture Amazon activities, see [Working with CloudTrail trails](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-trails.html) in the *Amazon CloudTrail User Guide*.
+ Use Amazon encryption solutions, along with all default security controls within Amazon Web Services services.
+ Use advanced managed security services such as Amazon Macie, which assists in discovering and securing sensitive data that is stored in Amazon S3.
+ If you require FIPS 140-3 validated cryptographic modules when accessing Amazon through a command line interface or an API, use a FIPS endpoint. For more information about the available FIPS endpoints, see [Federal Information Processing Standard (FIPS) 140-3](https://www.amazonaws.cn/compliance/fips/).

We strongly recommend that you never put confidential or sensitive information, such as your customers' email addresses, into tags or free-form text fields such as a **Name** field. This includes when you work with this Amazon product or service or other Amazon Web Services services using the console, API, Amazon CLI, or Amazon SDKs. Any data that you enter into tags or free-form text fields used for names may be used for billing or diagnostic logs. If you provide a URL to an external server, we strongly recommend that you do not include credentials information in the URL to validate your request to that server.

# Identity and Access Management
Identity and Access Management

Amazon Identity and Access Management (IAM) is an Amazon Web Services service that helps an administrator securely control access to Amazon resources. IAM administrators control who can be *authenticated* (signed in) and *authorized* (have permissions) to use Amazon resources. IAM is an Amazon Web Services service that you can use with no additional charge.

**Topics**
+ [

## Audience
](#security_iam_audience)
+ [

## Authenticating with identities
](#security_iam_authentication)
+ [

## Managing access using policies
](#security_iam_access-manage)
+ [

## How Amazon Web Services services work with IAM
](#security_iam_service-with-iam)
+ [

## Troubleshooting Amazon identity and access
](#security_iam_troubleshoot)

## Audience


How you use Amazon Identity and Access Management (IAM) differs, depending on the work that you do in Amazon.

**Service user** – If you use Amazon Web Services services to do your job, then your administrator provides you with the credentials and permissions that you need. As you use more Amazon features to do your work, you might need additional permissions. Understanding how access is managed can help you request the right permissions from your administrator. If you cannot access a feature in Amazon, see [Troubleshooting Amazon identity and access](#security_iam_troubleshoot) or the user guide of the Amazon Web Services service you are using.

**Service administrator** – If you're in charge of Amazon resources at your company, you probably have full access to Amazon. It's your job to determine which Amazon features and resources your service users should access. You must then submit requests to your IAM administrator to change the permissions of your service users. Review the information on this page to understand the basic concepts of IAM. To learn more about how your company can use IAM with Amazon, see the user guide of the Amazon Web Services service you are using.

**IAM administrator** – If you're an IAM administrator, you might want to learn details about how you can write policies to manage access to Amazon. To view example Amazon identity-based policies that you can use in IAM, see the user guide of the Amazon Web Services service you are using.

## Authenticating with identities


Authentication is how you sign in to Amazon using your identity credentials. You must be authenticated as the Amazon Web Services account root user, an IAM user, or by assuming an IAM role.

For programmatic access, Amazon provides an SDK and CLI to cryptographically sign requests. For more information, see [Amazon Signature Version 4 for API requests](https://docs.amazonaws.cn/IAM/latest/UserGuide/reference_sigv.html) in the *IAM User Guide*.

### Amazon Web Services account root user


 When you create an Amazon Web Services account, you begin with one sign-in identity called the Amazon Web Services account *root user* that has complete access to all Amazon Web Services services and resources. We strongly recommend that you don't use the root user for everyday tasks. For tasks that require root user credentials, see [Tasks that require root user credentials](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_root-user.html#root-user-tasks) in the *IAM User Guide*. 

### Federated identity


As a best practice, require human users to use federation with an identity provider to access Amazon Web Services services using temporary credentials.

A *federated identity* is a user from your enterprise directory, web identity provider, or Amazon Directory Service that accesses Amazon Web Services services using credentials from an identity source. Federated identities assume roles that provide temporary credentials.

### IAM users and groups


An *[IAM user](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_users.html)* is an identity with specific permissions for a single person or application. We recommend using temporary credentials instead of IAM users with long-term credentials. For more information, see [Require human users to use federation with an identity provider to access Amazon using temporary credentials](https://docs.amazonaws.cn/IAM/latest/UserGuide/best-practices.html#bp-users-federation-idp) in the *IAM User Guide*.

An [https://docs.amazonaws.cn/IAM/latest/UserGuide/id_groups.html](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_groups.html) specifies a collection of IAM users and makes permissions easier to manage for large sets of users. For more information, see [Use cases for IAM users](https://docs.amazonaws.cn/IAM/latest/UserGuide/gs-identities-iam-users.html) in the *IAM User Guide*.

### IAM roles


An *[IAM role](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles.html)* is an identity with specific permissions that provides temporary credentials. You can assume a role by [switching from a user to an IAM role (console)](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles_use_switch-role-console.html) or by calling an Amazon CLI or Amazon API operation. For more information, see [Methods to assume a role](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles_manage-assume.html) in the *IAM User Guide*.

IAM roles are useful for federated user access, temporary IAM user permissions, cross-account access, cross-service access, and applications running on Amazon EC2. For more information, see [Cross account resource access in IAM](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*.

## Managing access using policies


You control access in Amazon by creating policies and attaching them to Amazon identities or resources. A policy defines permissions when associated with an identity or resource. Amazon evaluates these policies when a principal makes a request. Most policies are stored in Amazon as JSON documents. For more information about JSON policy documents, see [Overview of JSON policies](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies.html#access_policies-json) in the *IAM User Guide*.

Using policies, administrators specify who has access to what by defining which **principal** can perform **actions** on what **resources**, and under what **conditions**.

By default, users and roles have no permissions. An IAM administrator creates IAM policies and adds them to roles, which users can then assume. IAM policies define permissions regardless of the method used to perform the operation.

### Identity-based policies


Identity-based policies are JSON permissions policy documents that you attach to an identity (user, group, or role). These policies control what actions identities can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*.

Identity-based policies can be *inline policies* (embedded directly into a single identity) or *managed policies* (standalone policies attached to multiple identities). To learn how to choose between managed and inline policies, see [Choose between managed policies and inline policies](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies-choosing-managed-or-inline.html) in the *IAM User Guide*.

### Resource-based policies


Resource-based policies are JSON policy documents that you attach to a resource. Examples include IAM *role trust policies* and Amazon S3 *bucket policies*. In services that support resource-based policies, service administrators can use them to control access to a specific resource. You must [specify a principal](https://docs.amazonaws.cn/IAM/latest/UserGuide/reference_policies_elements_principal.html) in a resource-based policy.

Resource-based policies are inline policies that are located in that service. You can't use Amazon managed policies from IAM in a resource-based policy.

### Access control lists (ACLs)


Access control lists (ACLs) control which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format.

Amazon S3, Amazon WAF, and Amazon VPC are examples of services that support ACLs. To learn more about ACLs, see [Access control list (ACL) overview](https://docs.amazonaws.cn/AmazonS3/latest/userguide/acl-overview.html) in the *Amazon Simple Storage Service Developer Guide*.

### Other policy types


Amazon supports additional policy types that can set the maximum permissions granted by more common policy types:
+ **Permissions boundaries** – Set the maximum permissions that an identity-based policy can grant to an IAM entity. For more information, see [Permissions boundaries for IAM entities](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide*.
+ **Service control policies (SCPs)** – Specify the maximum permissions for an organization or organizational unit in Amazon Organizations. For more information, see [Service control policies](https://docs.amazonaws.cn/organizations/latest/userguide/orgs_manage_policies_scps.html) in the *Amazon Organizations User Guide*.
+ **Resource control policies (RCPs)** – Set the maximum available permissions for resources in your accounts. For more information, see [Resource control policies (RCPs)](https://docs.amazonaws.cn/organizations/latest/userguide/orgs_manage_policies_rcps.html) in the *Amazon Organizations User Guide*.
+ **Session policies** – Advanced policies passed as a parameter when creating a temporary session for a role or federated user. For more information, see [Session policies](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies.html#policies_session) in the *IAM User Guide*.

### Multiple policy types


When multiple types of policies apply to a request, the resulting permissions are more complicated to understand. To learn how Amazon determines whether to allow a request when multiple policy types are involved, see [Policy evaluation logic](https://docs.amazonaws.cn/IAM/latest/UserGuide/reference_policies_evaluation-logic.html) in the *IAM User Guide*.

## How Amazon Web Services services work with IAM


To get a high-level view of how Amazon Web Services services work with most IAM features, see [Amazon services that work with IAM](https://docs.amazonaws.cn/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide*.

To learn how to use a specific Amazon Web Services service with IAM, see the security section of the relevant service's User Guide.

## Troubleshooting Amazon identity and access


Use the following information to help you diagnose and fix common issues that you might encounter when working with Amazon and IAM.

**Topics**
+ [

### I am not authorized to perform an action in Amazon
](#security_iam_troubleshoot-no-permissions)
+ [

### I am not authorized to perform iam:PassRole
](#security_iam_troubleshoot-passrole)
+ [

### I want to allow people outside of my Amazon Web Services account to access my Amazon resources
](#security_iam_troubleshoot-cross-account-access)

### I am not authorized to perform an action in Amazon


If you receive an error that you're not authorized to perform an action, your policies must be updated to allow you to perform the action.

The following example error occurs when the `mateojackson` IAM user tries to use the console to view details about a fictional `my-example-widget` resource but doesn't have the fictional `awes:GetWidget` permissions.

```
User: arn:aws-cn:iam::123456789012:user/mateojackson is not authorized to perform: awes:GetWidget on resource: my-example-widget
```

In this case, the policy for the `mateojackson` user must be updated to allow access to the `my-example-widget` resource by using the `awes:GetWidget` action.

If you need help, contact your Amazon administrator. Your administrator is the person who provided you with your sign-in credentials.

### I am not authorized to perform iam:PassRole


If you receive an error that you're not authorized to perform the `iam:PassRole` action, your policies must be updated to allow you to pass a role to Amazon.

Some Amazon Web Services services allow you to pass an existing role to that service instead of creating a new service role or service-linked role. To do this, you must have permissions to pass the role to the service.

The following example error occurs when an IAM user named `marymajor` tries to use the console to perform an action in Amazon. However, the action requires the service to have permissions that are granted by a service role. Mary does not have permissions to pass the role to the service.

```
User: arn:aws-cn:iam::123456789012:user/marymajor is not authorized to perform: iam:PassRole
```

In this case, Mary's policies must be updated to allow her to perform the `iam:PassRole` action.

If you need help, contact your Amazon administrator. Your administrator is the person who provided you with your sign-in credentials.

### I want to allow people outside of my Amazon Web Services account to access my Amazon resources


You can create a role that users in other accounts or people outside of your organization can use to access your resources. You can specify who is trusted to assume the role. For services that support resource-based policies or access control lists (ACLs), you can use those policies to grant people access to your resources.

To learn more, consult the following:
+ To learn whether Amazon supports these features, see [How Amazon Web Services services work with IAM](#security_iam_service-with-iam).
+ To learn how to provide access to your resources across Amazon Web Services accounts that you own, see [Providing access to an IAM user in another Amazon Web Services account that you own](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html) in the *IAM User Guide*.
+ To learn how to provide access to your resources to third-party Amazon Web Services accounts, see [Providing access to Amazon Web Services accounts owned by third parties](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html) in the *IAM User Guide*.
+ To learn how to provide access through identity federation, see [Providing access to externally authenticated users (identity federation)](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html) in the *IAM User Guide*.
+ To learn the difference between using roles and resource-based policies for cross-account access, see [Cross account resource access in IAM](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*.

# Compliance Validation for this Amazon Product or Service
Compliance Validation

To learn whether an Amazon Web Services service is within the scope of specific compliance programs, see [Amazon Web Services services in Scope by Compliance Program](https://aws.amazon.com/compliance/services-in-scope/) and choose the compliance program that you are interested in. For general information, see [Amazon Web Services Compliance Programs](https://aws.amazon.com/compliance/programs/).

You can download third-party audit reports using Amazon Artifact. For more information, see [Downloading Reports in Amazon Artifact](https://docs.aws.amazon.com/artifact/latest/ug/downloading-documents.html).

Your compliance responsibility when using Amazon Web Services services is determined by the sensitivity of your data, your company's compliance objectives, and applicable laws and regulations. For more information about your compliance responsibility when using Amazon Web Services services, see [Amazon Security Documentation](https://docs.amazonaws.cn/security/).

This Amazon product or service follows the [shared responsibility model](http://www.amazonaws.cn/compliance/shared-responsibility-model/) through the specific Amazon Web Services (Amazon) services it supports. For Amazon service security information, see the [Amazon service security documentation page](https://docs.amazonaws.cn/security/?id=docs_gateway#aws-security) and [Amazon services that are in scope of Amazon compliance efforts by compliance program](http://www.amazonaws.cn/compliance/services-in-scope/).

# Resilience for this Amazon Product or Service
Resilience

The Amazon global infrastructure is built around Amazon Web Services Regions and Availability Zones. 

Amazon Web Services Regions provide multiple physically separated and isolated Availability Zones, which are connected with low-latency, high-throughput, and highly redundant networking. 

With Availability Zones, you can design and operate applications and databases that automatically fail over between zones without interruption. Availability Zones are more highly available, fault tolerant, and scalable than traditional single or multiple data center infrastructures. 

For more information about Amazon Regions and Availability Zones, see [Amazon Global Infrastructure](http://www.amazonaws.cn/about-aws/global-infrastructure/).

This Amazon product or service follows the [shared responsibility model](http://www.amazonaws.cn/compliance/shared-responsibility-model/) through the specific Amazon Web Services (Amazon) services it supports. For Amazon service security information, see the [Amazon service security documentation page](https://docs.amazonaws.cn/security/?id=docs_gateway#aws-security) and [Amazon services that are in scope of Amazon compliance efforts by compliance program](http://www.amazonaws.cn/compliance/services-in-scope/).

# Infrastructure Security for this Amazon Product or Service
Infrastructure Security

This Amazon product or service uses managed services, and therefore is protected by the Amazon global network security. For information about Amazon security services and how Amazon protects infrastructure, see [Amazon Cloud Security](https://www.amazonaws.cn/security/). To design your Amazon environment using the best practices for infrastructure security, see [Infrastructure Protection](https://docs.amazonaws.cn/wellarchitected/latest/security-pillar/infrastructure-protection.html) in *Security Pillar Amazon Well‐Architected Framework*.

You use Amazon published API calls to access this Amazon Product or Service through the network. Clients must support the following:
+ Transport Layer Security (TLS). We require TLS 1.2 and recommend TLS 1.3.
+ Cipher suites with perfect forward secrecy (PFS) such as DHE (Ephemeral Diffie-Hellman) or ECDHE (Elliptic Curve Ephemeral Diffie-Hellman). Most modern systems such as Java 7 and later support these modes.

Additionally, requests must be signed by using an access key ID and a secret access key that is associated with an IAM principal. Or you can use the [Amazon Security Token Service](https://docs.amazonaws.cn/STS/latest/APIReference/Welcome.html) (Amazon STS) to generate temporary security credentials to sign requests.

This Amazon product or service follows the [shared responsibility model](http://www.amazonaws.cn/compliance/shared-responsibility-model/) through the specific Amazon Web Services (Amazon) services it supports. For Amazon service security information, see the [Amazon service security documentation page](https://docs.amazonaws.cn/security/?id=docs_gateway#aws-security) and [Amazon services that are in scope of Amazon compliance efforts by compliance program](http://www.amazonaws.cn/compliance/services-in-scope/).

# Enforcing a minimum version of TLS
TLS 1.3 is now supported across all Amazon service API endpoints in all Regions

Updated supported TLS version and method for logging TLS version.Enforcing a minimum version of TLS

Added information about TLS 1.3.

To add increased security when communicating with Amazon services, configure the Amazon SDK for JavaScript to use TLS 1.2 or later. 

Transport Layer Security (TLS) is a protocol used by web browsers and other applications to ensure the privacy and integrity of data exchanged over a network.

**Important**  
As of June 10, 2024, we [announced](https://amazonaws-china.com/blogs//security/faster-aws-cloud-connections-with-tls-1-3/) that TLS 1.3 is available on Amazon service API endpoints across each of the Amazon Regions. The Amazon SDK for JavaScript v2 does not negotiate the TLS version itself. Instead, it uses the TLS version determined by Node.js, which is configurable via `https.Agent`. Amazon recommends using the current Active LTS version of Node.js.

## Verify and enforce TLS in Node.js


When you use the Amazon SDK for JavaScript with Node.js, the underlying Node.js security layer is used to set the TLS version.

Node.js 12.0.0 and later use a minimum version of OpenSSL 1.1.1b, which supports TLS 1.3. The Amazon SDK for JavaScript v2 defaults to use TLS 1.3 when available, but defaults to a lower version if required.

### Verify the version of OpenSSL and TLS


To get the version of OpenSSL used by Node.js on your computer, run the following command.

```
node -p process.versions
```

The version of OpenSSL in the list is the version used by Node.js, as shown in the following example.

```
openssl: '1.1.1b'
```

To get the version of TLS used by Node.js on your computer, start the Node shell and run the following commands, in order.

```
> var tls = require("tls");
> var tlsSocket = new tls.TLSSocket();
> tlsSocket.getProtocol();
```

The last command outputs the TLS version, as shown in the following example.

```
'TLSv1.3'
```

Node.js defaults to use this version of TLS, and tries to negotiate another version of TLS if a call is not successful.

### Checking Minimum and Maximum Supported TLS Versions


Developers can check the minimum and maximum supported TLS versions in Node.js using the following script:

```
var tls = require("tls");
console.log("Supported TLS versions:", tls.DEFAULT_MIN_VERSION + " to " + tls.DEFAULT_MAX_VERSION);
```

The last command outputs the default minimum and maximum TLS version, as shown in the following example.

```
Supported TLS versions: TLSv1.2 to TLSv1.3
```

### Enforce a minimum version of TLS


Node.js negotiates a version of TLS when a call fails. You can enforce the minimum allowable TLS version during this negotiation, either when running a script from the command line or per request in your JavaScript code. 

To specify the minimum TLS version from the command line, you must use Node.js version 11.4.0 or later. To install a specific Node.js version, first install Node Version Manager (nvm) using the steps found at [Node Version Manager Installing and Updating](https://github.com/nvm-sh/nvm#installing-and-updating). Then run the following commands to install and use a specific version of Node.js. 

```
nvm install 11
nvm use 11
```

------
#### [ Enforcing TLS 1.2 ]

To enforce that TLS 1.2 is the minimum allowable version, specify the `--tls-min-v1.2` argument when running your script, as shown in the following example.

```
node --tls-min-v1.2 yourScript.js
```

To specify the minimum allowable TLS version for a specific request in your JavaScript code, use the `httpOptions` parameter to specify the protocol, as shown in the following example.

```
const https = require("https");
const {NodeHttpHandler} = require("@aws-sdk/node-http-handler");
const {DynamoDBClient} = require("@aws-sdk/client-dynamodb");

const client = new DynamoDBClient({
    region: "us-west-2",
    requestHandler: new NodeHttpHandler({
        httpsAgent: new https.Agent(
            {
                secureProtocol: 'TLSv1_2_method'
            }
        )
    })
});
```

------
#### [ Enforcing TLS 1.3 ]

To enforce that TLS 1.3 is the minimum allowable version, specify the `--tls-min-v1.3` argument when running your script, as shown in the following example.

```
node --tls-min-v1.3 yourScript.js
```

To specify the minimum allowable TLS version for a specific request in your JavaScript code, use the `httpOptions` parameter to specify the protocol, as shown in the following example.

```
const https = require("https");
const {NodeHttpHandler} = require("@aws-sdk/node-http-handler");
const {DynamoDBClient} = require("@aws-sdk/client-dynamodb");

const client = new DynamoDBClient({
    region: "us-west-2",
    requestHandler: new NodeHttpHandler({
        httpsAgent: new https.Agent(
            {
                secureProtocol: 'TLSv1_3_method'
            }
        )
    })
});
```

------

## Verify and enforce TLS in a browser script


When you use the SDK for JavaScript in a browser script, browser settings control the version of TLS that is used. The version of TLS used by the browser cannot be discovered or set by script and must be configured by the user. To verify and enforce the version of TLS used in a browser script, refer to the instructions for your specific browser.

------
#### [ Microsoft Internet Explorer ]

1. Open **Internet Explorer**.

1. From the menu bar, choose **Tools** - **Internet Options** - **Advanced** tab.

1. Scroll down to **Security** category, manually check the option box for **Use TLS 1.2**.

1. Click **OK**.

1. Close your browser and restart Internet Explorer.

------
#### [ Microsoft Edge ]

1. In the Windows menu search box, type *Internet options*.

1. Under **Best match**, click **Internet Options**.

1. In the **Internet Properties** window, on the **Advanced** tab, scroll down to the **Security** section.

1. Check the **User TLS 1.2** checkbox.

1. Click **OK**.

------
#### [ Google Chrome ]

1. Open **Google Chrome**.

1. Click **Alt F** and select **Settings**.

1. Scroll down and select **Show advanced settings...**.

1. Scroll down to the **System** section and click on **Open proxy settings...**.

1. Select the **Advanced** tab.

1. Scroll down to **Security** category, manually check the option box for **Use TLS 1.2**.

1. Click **OK**.

1. Close your browser and restart Google Chrome.

------
#### [ Mozilla Firefox ]

1. Open **Firefox**.

1. In the address bar, type **about:config** and press Enter.

1. In the **Search** field, enter **tls**. Find and double-click the entry for **security.tls.version.min**.

1. Set the integer value to 3 to force protocol of TLS 1.2 to be the default.

1. Click **OK**.

1. Close your browser and restart Mozilla Firefox.

------
#### [ Apple Safari ]

There are no options for enabling SSL protocols. If you are using Safari version 7 or greater, TLS 1.2 is automatically enabled.

------