fix(graphql-elasticsearch-transformer): enforce HTTPS so TLS 1.2 applies on v1 searchable - #3498
Merged
Merged
Conversation
…ies on v1 searchable PR #3456 set `DomainEndpointOptions.TLSSecurityPolicy` to `Policy-Min-TLS-1-2-2019-07` on the v1 (Elasticsearch) searchable domain but did not set `EnforceHTTPS`. On AWS::Elasticsearch::Domain the minimum TLS policy only governs the HTTPS endpoint, so without `EnforceHTTPS: true` the policy is not actually applied and the domain keeps reporting `Policy-Min-TLS-1-0-2019-07` — which is why e2e still saw a Policy-Min-TLS-1-0 CREATE_FAILED for v1 searchable after #3456 merged. The companion v2 (OpenSearch) fix in #3472 already pairs `enforceHttps: true` with `tlsSecurityPolicy: TLS_1_2`, so only the v1 path was left incomplete. Add `EnforceHTTPS: true` to the v1 domain's `DomainEndpointOptions` so the TLS 1.2 minimum is enforced, matching v2. Update the existing unit test, which incorrectly asserted `EnforceHTTPS` was undefined, to assert true. Validated with `jest SearchableModelTransformer`: 7 passed, 7 snapshots, resources.ts at 100% coverage.
6 tasks
Simone319
approved these changes
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
TLS 1.2 gap on the v1 (Elasticsearch) searchable domain
PR #3456 set
DomainEndpointOptions.TLSSecurityPolicytoPolicy-Min-TLS-1-2-2019-07on the v1 Elasticsearch searchable domain but omittedEnforceHTTPS. OnAWS::Elasticsearch::Domainthe minimum TLS policy only governs the HTTPS endpoint, so withoutEnforceHTTPS: truethe policy is never applied and the domain keeps reportingPolicy-Min-TLS-1-0-2019-07. This is why amplify-cli e2e still saw aPolicy-Min-TLS-1-0CREATE_FAILEDfor v1 searchable after #3456 merged.The companion v2 (OpenSearch) fix in #3472 already pairs
enforceHttps: truewithtlsSecurityPolicy: TLS_1_2, so only the v1 path was left incomplete.Fix
Add
EnforceHTTPS: trueto the v1 domain'sDomainEndpointOptions, matching v2 behavior. The existing unit test (which incorrectly assertedEnforceHTTPSwas undefined) is updated to asserttrue.Testing
jest SearchableModelTransformer: 7 passed, 7 snapshots passed,resources.tsat 100% coverage.Split out from #3494 (PR-5 of the full split).