chore(elbv2): add post-quantum cryptography SSL policies #36297
+94
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Add 6 new post-quantum hybrid key exchange SSL policies using ML-KEM * TLS13_13_PQ: TLS 1.3 only with quantum resistance * TLS13_12_PQ: TLS 1.2 and 1.3 with quantum resistance * TLS13_12_RES_PQ: Restricted cipher suite with quantum resistance * TLS13_12_EXT1_PQ: Extended cipher suite 1 with quantum resistance * TLS13_12_EXT2_PQ: Extended cipher suite 2 with quantum resistance * TLS13_10_PQ: TLS 1.0 through 1.3 with quantum resistance - Add 8 new FIPS-compliant post-quantum cryptography SSL policies * FIPS_TLS13_13_PQ: FIPS TLS 1.3 only with quantum resistance * FIPS_TLS13_12_PQ: FIPS TLS 1.2 and 1.3 with quantum resistance * FIPS_TLS13_12_RES_PQ: FIPS restricted cipher suite with quantum resistance * FIPS_TLS13_12_EXT0_PQ: FIPS extended cipher suite 0 with quantum resistance * FIPS_TLS13_12_EXT1_PQ: FIPS extended cipher suite 1 with quantum resistance * FIPS_TLS13_12_EXT2_PQ: FIPS extended cipher suite 2 with quantum resistance * FIPS_TLS13_11_PQ: FIPS TLS 1.1 through 1.3 with quantum resistance * FIPS_TLS13_10_PQ: FIPS TLS 1.0 through 1.3 with quantum resistance - Support AWS recommended post-quantum cryptography policies for enhanced security
github-actions
bot
added
feature-request
aws-cdk-automation
previously requested changes
Dec 4, 2025
pahud
changed the title
aws-cdk-automation
dismissed
their stale review
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
aws-cdk-automation
added
the
pr/needs-maintainer-review
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
Closes #36283.
Reason for this change
AWS announced support for post-quantum (PQ) security policies for Application Load Balancers and Network Load Balancers on November 21, 2025. These policies use hybrid post-quantum key exchange with ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) to protect against "Harvest Now, Decrypt Later" attacks. The CDK's
SslPolicyenum currently lacks these new policies, forcing users to use string literals and losing type safety.Description of changes
Added 14 new post-quantum security policy enum values to the
SslPolicyenum inpackages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/enums.ts:Standard TLS Policies with PQ:
TLS13_13_PQ- TLS 1.3 only with post-quantum hybrid key exchangeTLS13_12_PQ- TLS 1.2 and 1.3 with post-quantum hybrid key exchangeTLS13_12_RES_PQ- TLS 1.2 and 1.3 restricted cipher suite with PQ (AWS recommended)TLS13_12_EXT1_PQ- TLS 1.2 and 1.3 extended cipher suite 1 with PQTLS13_12_EXT2_PQ- TLS 1.2 and 1.3 extended cipher suite 2 with PQTLS13_10_PQ- TLS 1.0 through 1.3 with post-quantum hybrid key exchangeFIPS-Compliant Policies with PQ:
FIPS_TLS13_13_PQ- TLS 1.3 only FIPS-compliant with PQFIPS_TLS13_12_PQ- TLS 1.2 and 1.3 FIPS-compliant with PQFIPS_TLS13_12_RES_PQ- TLS 1.2 and 1.3 restricted FIPS-compliant with PQ (AWS recommended for FIPS)FIPS_TLS13_12_EXT0_PQ- TLS 1.2 and 1.3 extended cipher suite 0 FIPS-compliant with PQFIPS_TLS13_12_EXT1_PQ- TLS 1.2 and 1.3 extended cipher suite 1 FIPS-compliant with PQFIPS_TLS13_12_EXT2_PQ- TLS 1.2 and 1.3 extended cipher suite 2 FIPS-compliant with PQFIPS_TLS13_11_PQ- TLS 1.1 through 1.3 FIPS-compliant with PQFIPS_TLS13_10_PQ- TLS 1.0 through 1.3 FIPS-compliant with PQAll enum values map to their corresponding AWS policy names (e.g.,
ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09) and include JSDoc comments describing their purpose and quantum resistance capabilities.This is a purely additive change with no breaking changes. All existing enum values remain unchanged.
Description of changes to permissions
N/A - This change only adds enum values and does not modify IAM permissions or resource access patterns.
Description of how you validated changes
aws elbv2 describe-ssl-policiesto verify post-quantum policy names exist in AWSOfficial AWS Documentation Proof:
All 14 policy names are documented in the official AWS ELB documentation:
The documentation explicitly lists all PQ policies in the "Protocols by policy" and "Ciphers by policy" tables, including:
ELBSecurityPolicy-TLS13-1-3-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09,ELBSecurityPolicy-TLS13-1-0-PQ-2025-09ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09,ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09,ELBSecurityPolicy-TLS13-1-1-FIPS-PQ-2025-09,ELBSecurityPolicy-TLS13-1-0-FIPS-PQ-2025-09AWS documentation states: "Security policies with PQ in their names offer hybrid post-quantum key exchange. For compatibility, they support both classical and post-quantum ML-KEM key exchange algorithms."
Live AWS API Validation:
Validation script (
poc.sh) confirmed 13 of 14 policies are currently available via the AWS API:Note:
ELBSecurityPolicy-TLS13-1-1-FIPS-PQ-2025-09is documented but not yet available in the live AWS API (may be rolling out or region-specific). All enum values match the official AWS documentation.Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license