See issue #3688 in aws-cli GitHub.
The original issue from
timwins in October 2018:
PCI DSS requires "strong encryption" for non-console administrative access. This means TLS 1.1 or greater per the PCI SSC guidance. According to the Python documentation (https://docs.python.org/2/library/ssl.html) the server sets the minimum SSL/TLS requirements - I assume with the ssl.wrap_socket parameters and the server certificate. It seems likely the Protocol parameter is set to SSLv23. Is that true? This allows SSLv3 and TLS v1 to be negotiated.
Can this be forced to TLSv1.1 or TLSv1.2 by a client configuration?
The client and server will always negotiate the latest version of TLS. All AWS services support TLS 1.2, so as long as you are using a version of python compiled against a recent version of openssl you should be good. That said there's not currently a way to black list old tls versions, so you will need to make sure that any non-aws endpoints you may be configuring support the latest versions.
JordonPhillips also marked this issue as a feature request in November 2018, so hopefully there might be further development at some future time.
Thanks. Then we can tell customers needing to meet PCI DSS compliance that they are responsible for using the most current CLI, or at least version 3.6.0(?) of Python.
It looks like the combination of Python 3.7 or above and OpenSSL 1.1.0g or above will provide a SSLContext.minimum_version that will finally allow programmatically specifying a restriction like "TLS 1.2 or above" in Python in a clean, forward-compatible way.
Before that, it looks like the available options only allowed specifying options like "TLS 1.2 only" which is not ideal if you want an open-ended restriction like "TLS 1.2 or better", potentially allowing the underlying layers to support versions of TLS the
aws-cli is not yet specifically aware of.
Maybe this will enable the development of this requested feature in