API Gateway custom domain should not use the legacy TLS 1.0 security policy

What it checks

API Gateway custom domain should not use the legacy TLS 1.0 security policy

Where it applies

Terraform: aws_api_gateway_domain_name

CloudFormation: AWS::ApiGateway::DomainName

How to fix it

1. Set security_policy = "TLS_1_2" on the custom domain. All modern TLS clients support TLS 1.2.

Frameworks

• NIST 800-53 rev5 SC-8
• SOC 2 CC6.7

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules