This rule raises an issue when an insecure TLS protocol version (i.e. a protocol different from "TLSv1.2", "TLSv1.3", "DTLSv1.2", or "DTLSv1.3") is used or allowed.

It is recommended to enforce TLS 1.2 as the minimum protocol version and to disallow older versions like TLS 1.0. Failure to do so could open the door to downgrade attacks: a malicious actor who is able to intercept the connection could modify the requested protocol version and downgrade it to a less secure version.

Noncompliant Code Example

from OpenSSL import SSL

SSL.Context(SSL.SSLv3_METHOD)  # Noncompliant

import ssl

ssl.SSLContext(ssl.PROTOCOL_SSLv3) # Noncompliant

For aws_cdk.aws_apigateway.DomainName:

from aws_cdk.aws_apigateway import DomainName, SecurityPolicy
class ExampleStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        DomainName(self, "example",
            domain_name="example.com",
            certificate=certificate,
            security_policy=SecurityPolicy.TLS_1_0 # Noncompliant
        )

For aws_cdk.aws_opensearchservice.CfnDomain:

from aws_cdk.aws_opensearchservice import CfnDomain, EngineVersion
class ExampleStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        CfnDomain(self, "example",
            version=EngineVersion.OPENSEARCH_1_3
        ) # Noncompliant: enables TLS 1.0 which is a deprecated version of the protocol

Compliant Solution

from OpenSSL import SSL

SSL.Context(SSL.TLSv1_2_METHOD)

import ssl

ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)

For aws_cdk.aws_apigateway.DomainName:

from aws_cdk.aws_apigateway import DomainName, SecurityPolicy
class ExampleStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        DomainName(self, "example",
            domain_name="example.com",
            certificate=certificate,
            security_policy=SecurityPolicy.TLS_1_2
        )

For aws_cdk.aws_opensearchservice.CfnDomain:

from aws_cdk.aws_opensearchservice import CfnDomain, EngineVersion
class ExampleStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        CfnDomain(self, "example",
            version=EngineVersion.OPENSEARCH_1_3
            domain_endpoint_options=CfnDomain.DomainEndpointOptionsProperty(
                tls_security_policy="Policy-Min-TLS-1-2-2019-07"
            )
        )

See