[Johnbjoseph-cybersec]

aws-insecure-api-gateway-tls-version exempts only security_policy = "TLS_1_2" on aws_api_gateway_domain_name. Every other value gets "insecure version of TLS" and the advice to go back to TLS_1_2.

That now includes the enhanced policies API Gateway accepts for REST custom domains (API_DomainName). Each one starts with SecurityPolicy_TLS12 or SecurityPolicy_TLS13, and each is as strict as TLS_1_2 or stricter (policy table):

• SecurityPolicy_TLS13_1_3_2025_09 and SecurityPolicy_TLS13_2025_EDGE allow only TLS 1.3.
• The _PQ_ policies keep a TLS 1.2 floor and add hybrid post-quantum key exchange.

So a team that moves to TLS 1.3 or PQ gets a warning telling them to step back down.

Changes:

• The v1 pattern-not now binds $POLICY and exempts ^['"](TLS_1_2|SecurityPolicy_TLS1[23]_[A-Z0-9_]+)['"]$. The regex includes the surrounding quotes because a Terraform string bound to a metavariable keeps them, the same way aws-ec2-security-group-rule-missing-description matches its description strings.
• The message now names the enhanced policies, and the references list now links the AWS policy table.
• Added three ok: cases (TLS 1.3 only, PQ and edge), each with endpoint_access_mode, which AWS requires with any SecurityPolicy_ policy. All three are flagged by the current rule and pass with this change. The TLS_1_0 ruleid: case is unchanged.

aws_apigatewayv2_domain_name is unchanged. HTTP and WebSocket APIs only support TLS_1_2, and the provider's validation only accepts TLS_1_2 for that resource.

John B Joseph, Co-founder & CPTO, Purplecop Security