feat(opensearchservice): TLS security policy for TLS 1.3 and perfect forward secrecy

[go-to-k]

This PR supports new TLS security policy 'Policy-Min-TLS-1-2-PFS-2023-10' for TLS 1.3 and perfect forward secrecy.

The description from CLI reference:

Policy-Min-TLS-1-2-PFS-2023-10: TLS security policy that supports TLS version 1.2 to TLS version 1.3 with perfect forward secrecy cipher suites

• Release notes
  • https://aws.amazon.com/jp/about-aws/whats-new/2024/01/amazon-opensearch-service-tls-1-3-perfect-forward-secrecy/
• CloudFormation
  • https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-opensearchservice-domain-domainendpointoptions.html#cfn-opensearchservice-domain-domainendpointoptions-tlssecuritypolicy

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[go-to-k]

Exemption Request: This PR just adds the version as enum property.

[lpizzinidev]

Thanks 👍 Just a minor adjustment on naming in my opinion.

[lpizzinidev]

Suggested change

	TLS_1_2_PFS = 'Policy-Min-TLS-1-2-PFS-2023-10',
	TLS_1_3 = 'Policy-Min-TLS-1-2-PFS-2023-10',

I think it's clearer if we specify v1.3.

[go-to-k]

Thanks for your review.

I thought about that too, but do we not have to think about the future appearance of a new option that only allows TLS 1.3 (does not include 1.2)?

Also, there is hesitation in key names that are not in line with the value, what do you think?

[lpizzinidev]

do we not have to think about the future appearance of a new option that only allows TLS 1.3

Good point, thanks for the follow-up 👍

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 30fe757
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).