如何使用 AWS CloudFormation 在 AWS API Gateway 上应用安全策略？

Question

I have a simple cloudformation template which is creating a Custom Domain for an API Gateway,
The template is able to create the Custom domain.

But I cannot find the cloudformation property to set the Custom Domain Security Policy to TLS 1.2 ,
The template creates a custom domain with the default TLS 1.0 Security Policy

Template -

AWSTemplateFormatVersion: 2010-09-09
Transform: 'AWS::Serverless-2016-10-31'
Description: Test Custom Domain

Resources:
  test:
    Type: AWS::ApiGateway::DomainName
    Properties: 
      CertificateArn: !Sub 'arn:aws:acm:${AWS::Region}:${AWS::AccountId}:certificate/xxxx-xxx-xxx-xxxx-xxxx'
      DomainName: 'test-api.example.com'
      EndpointConfiguration: 
        Types: 
          - 'EDGE'

Reference -
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-domainname.html

Answer 1

This parameter is unfortunately not yet exposed though CloudFormation.

There is a ticket here tracking its progression - https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/3

For now, your best bet would be to create a custom CloudFormation resource.

This parameter is exposed via the API and can be used by (at least some of) their SDKs - https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/apigateway.html#APIGateway.Client.create_domain_name

Here are the docs which talk about how how to create customer resources - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-custom-resources.html

Answer 2

Support for specifying the Security Policy on an API Gateway domain was added in July 2020. Documentation for how to add this parameter to a CloudFormation Template is provided on AWS Docs . Valid values for Security Policy are TLS_1_0 or TLS_1_2 . Example below:

ApiCustomDomainName:
  Type: 'AWS::ApiGateway::DomainName'
  Condition: ApiGatewayEnabled
  Properties:
    DomainName: "example.com"
    RegionalCertificateArn: !Ref CertificateArn
    securityPolicy: "TLS_1_2"
      EndpointConfiguration:
        Types:
          - REGIONAL