bug(misconf): AWS-0112 only accepts TLS_1_2 and rejects the newer secure policies

Description

The check accepts only the literal value TLS_1_2 for the SAM API domain security policy:

checks/cloud/aws/sam/api_use_secure_tls_policy.rego:

is_secure_tls_policy(api) if value.is_equal(api.domainconfiguration.securitypolicy, "TLS_1_2")

Domain in AWS::Serverless::Api creates an API Gateway custom domain name, whose securityPolicy accepts 12 values. Only TLS_1_0 is insecure, every other value enforces TLS 1.2 or higher:

• TLS_1_0
• TLS_1_2
• SecurityPolicy_TLS13_1_3_2025_09
• SecurityPolicy_TLS13_1_3_FIPS_2025_09
• SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09
• SecurityPolicy_TLS13_1_2_FIPS_PQ_2025_09
• SecurityPolicy_TLS13_1_2_FIPS_PFS_PQ_2025_09
• SecurityPolicy_TLS13_1_2_PQ_2025_09
• SecurityPolicy_TLS13_1_2_2021_06
• SecurityPolicy_TLS13_2025_EDGE
• SecurityPolicy_TLS12_PFS_2025_EDGE
• SecurityPolicy_TLS12_2018_EDGE

So the check reports 10 secure policies, including the TLS 1.3 only ones, as outdated.

Note that the two AWS documentation pages are each missing one of the FIPS policies. The SecurityPolicy enum in the AWS SDK is the complete list.

Reproduction

Resources:
  Example:
    Type: AWS::Serverless::Api
    Properties:
      Domain:
        SecurityPolicy: SecurityPolicy_TLS13_1_2_2021_06
      Name: Example
      StageName: Prod

Output:

AWS-0112 (HIGH): Domain name is configured with an outdated TLS policy.

Expected

Only TLS_1_0 produce a finding.

Fix

AWS-0005 already handles the same field correctly for aws_api_gateway_domain_name:

policies := ["TLS_1_2", "SecurityPolicy_TLS12_*_EDGE", "SecurityPolicy_TLS13_*"]

is_SecurityPolicy_TLS12(domain) if {
      some p in policies
      glob.match(p, [], domain.securitypolicy.value)
}

That set covers all 12 values correctly, and the patterns survive new policies of the same families being added, which an exact list of names does not.

Since two checks now need it, move the patterns and the matching helper into lib/ and use it from both AWS-0005 and AWS-0112, rather than duplicating the list.

# lib/cloud/aws_apigateway.rego
package lib.aws.apigateway

# Patterns rather than exact names, so policies added to the same families
# are covered without a change here.
secure_security_policies := [
      "TLS_1_2",
      "SecurityPolicy_TLS12_*_EDGE",
      "SecurityPolicy_TLS13_*",
]

# True if the security policy permits TLS versions below 1.2.
# Unresolvable values yield no result.
is_outdated_security_policy(policy) if {
      value.is_known(policy)
      not _is_secure_security_policy(policy)
}

_is_secure_security_policy(policy) if {
      some pattern in secure_security_policies
      glob.match(pattern, [], policy.value)
}

References

• Supported security policies (developer guide, omits SecurityPolicy_TLS13_1_2_FIPS_PQ_2025_09)
• API_DomainName (API reference, omits SecurityPolicy_TLS13_1_2_FIPS_PFS_PQ_2025_09)
• SecurityPolicy enum (complete list of 12 values)