New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature request: check API Gateway TLS termination policy #1598

Open

rdegraaf opened this issue Jan 18, 2024 · 0 comments

Labels

rdegraaf commented Jan 18, 2024 •

edited

Is your feature request related to a problem? Please describe.

AWS API Gateway Default Endpoints can be configured to use TLS 1.0 or newer, or to use TLS 1.2 or newer; see https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html for details.. More TLS termination policies may be added in the future. Unless support for obsolete clients is specifically required, most applications should require TLS 1.2 or newer.

Describe the solution you'd like

ScoutSuite should check that all API Gateway Custom Domains are configured to use the "TLS-1-2" security policy.

rdegraaf added the enhancement label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment