View a markdown version of this page

Working with TLS in the AWS SDK for Python - AWS SDK for Python
How TLS versions are selectedCheck TLS version informationEnforce a minimum TLS versionAWS API endpoints and TLS 1.2

Developer Preview — This documentation covers the AWS SDK for Python, which is in Developer Preview and intended for evaluation and testing only. Do not use it for production workloads. For production applications, use the AWS SDK for Python (Boto3). To understand the differences between the two SDKs, see Choosing the right AWS SDK for Python.

Working with TLS in the AWS SDK for Python

The AWS SDK for Python relies on the TLS implementation of its HTTP transport to secure connections to AWS services. AWS service endpoints require TLS 1.2 or later, and TLS 1.3 is recommended.

TLS 1.3 is required to enable post-quantum cryptography, which might require additional actions or configuration. To learn more, see Enabling hybrid post-quantum TLS.

How TLS versions are selected

The SDK does not select a specific TLS protocol version. The TLS behavior depends on the HTTP transport that the client's configuration uses:

  • By default, clients use AIOHTTPClient. This transport creates an aiohttp client session without supplying an SSL context. By default, aiohttp uses a verified SSL context created by Python's ssl module. The enabled versions and cipher suites depend on the TLS library used by the Python runtime and its configuration.

  • Clients configured with AWSCRTHTTPClient, which is required for HTTP/2 bidirectional streaming, use an AWS Common Runtime (CRT) TLS context with default options, and the SDK does not override its TLS-version settings. The enabled versions depend on AWS CRT and its platform TLS implementation.

When a connection is established, the transport negotiates a TLS version supported by both the client environment and the AWS service endpoint. Both built-in transports verify server certificates by default. If you provide a custom transport, consult its documentation for its TLS behavior.

Check TLS version information

For clients that use AIOHTTPClient, use the Python ssl module to inspect the TLS library and the version limits of the default SSL context:

import ssl

context = ssl.create_default_context()

print(f"TLS library: {ssl.OPENSSL_VERSION}")
print(f"Minimum TLS version: {context.minimum_version.name}")
print(f"Maximum TLS version: {context.maximum_version.name}")

The output depends on the Python runtime and platform. It shows the settings of the default Python SSL context, not the TLS version negotiated for a particular request.

This check does not apply to clients that use AWSCRTHTTPClient because that transport uses AWS CRT instead of Python's ssl module. The built-in CRT transport does not provide a public API for reporting the TLS version negotiated for a connection. If you need to confirm the negotiated version, use TLS diagnostic tooling appropriate for your environment.

Enforce a minimum TLS version

The SDK does not override the minimum TLS version of either built-in transport, and their public configuration does not provide a minimum-version setting. AWS service endpoints reject connections that use a version earlier than TLS 1.2.

If your application must explicitly enforce a minimum version on the client, provide a compatible custom HTTP transport through the generated client's transport configuration. Configure the transport or its TLS implementation to enforce the required minimum version, and follow the transport's documentation.

AWS API endpoints and TLS 1.2

For more information about the TLS 1.2 minimum for AWS API endpoints, see TLS 1.2 to become the minimum TLS protocol level for all AWS API endpoints.