Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · APIGateway

APIGateway.11: Domain names should use recommended security policies

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub APIGateway.11 check?

APIGateway.11 fails when a custom domain name doesn't use one of the recommended security policies. As of the November 2025 update, API Gateway classes both TLS_1_0 and TLS_1_2 as legacy policies, and the control's non-customisable allowedSecurityPolicies list only the enhanced 2025 policies: SecurityPolicy_TLS13_1_3_2025_09, SecurityPolicy_TLS13_1_3_FIPS_2025_09, SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09, SecurityPolicy_TLS13_2025_EDGE, and SecurityPolicy_TLS12_PFS_2025_EDGE. A security policy is a predefined combination of minimum TLS version and cipher suites that sets what the TLS handshake will accept.

Why does APIGateway.11 matter?

Because TLS negotiates the strongest protocol both sides support, a domain on a legacy policy can still look fine to a modern browser while accepting older protocols and weaker ciphers from any client that asks: exactly the kind of downgrade surface POODLE and BEAST exploited. The enhanced 2025 policies raise the floor to modern TLS (TLS 1.3, post-quantum, and PFS variants) and tighten the cipher suites, removing the weak combinations entirely and protecting data in transit against tampering and eavesdropping. Note that simply moving to the legacy TLS_1_2 policy is no longer enough to pass this control.

How do I fix APIGateway.11?

  1. Audit each custom domain's current securityPolicy.
  2. Move legacy domains (including any still on TLS_1_2) to one of the enhanced 2025 policies the control accepts via update-domain-name, and set the required endpoint access mode (start with BASIC, then move to STRICT after validating traffic).
  3. Allow for the propagation window and confirm the ACM certificate is compatible.
  4. Set the modern policy as the default in IaC and add a Config rule to catch drift.

Remediation script · bash

# Raise the search-domain TLS policy and keep HTTPS enforced (no downtime, no re-index).
aws opensearch update-domain-config \
  --domain-name logs-prod \
  --domain-endpoint-options '{"EnforceHTTPS":true,"TLSSecurityPolicy":"Policy-Min-TLS-1-2-PFS-2023-10"}'

# Pin an API Gateway custom domain to a recommended (enhanced 2025) TLS security policy.
# Enhanced policies require endpointAccessMode=STRICT, set in the same call.
aws apigateway update-domain-name \
  --domain-name api.example.com \
  --patch-operations '[{"op":"replace","path":"/securityPolicy","value":"SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"},{"op":"replace","path":"/endpointAccessMode","value":"STRICT"}]'

# Confirm the live policy once the domain settles.
aws opensearch describe-domain-config --domain-name logs-prod \
  --query 'DomainConfig.DomainEndpointOptions.Options.TLSSecurityPolicy' \
  --output text

Full walkthrough (console steps, edge cases and verification) in the lesson Enforce TLS on APIs and search domains.

Is APIGateway.11 a false positive?

Both edge-optimized and regional custom domains support choosing a security policy through the same mechanism. What differs is which enhanced policy values apply (for example the _EDGE policies) and how the endpoint access mode interacts with the endpoint type, not a different configuration method. Changes take roughly fifteen minutes to propagate, so a domain can still read as failing right after the update lands.

Full lesson Enforce TLS on APIs and search domains Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for APIGateway controls ↗ Check your own account for APIGateway.11 →
Part of the learning path Encrypt everything

More APIGateway controls