Checks whether an OSS bucket has Transport Layer Security (TLS) enabled and uses a TLS version within the range specified by the input parameter.
Scenarios
For secure data transmission, we recommend that you enable HTTPS (TLS encryption) on your OSS buckets and use TLSv1.2 or TLSv1.3.
Risk level
Default risk level: Medium.
You can change the risk level as needed.
Detection logic
-
An OSS bucket is considered compliant if TLS is enabled and its TLS version is one of the versions specified by the parameter. The default compliant versions are TLSv1.2 and TLSv1.3.
Rule details
|
Parameter |
Description |
|
Rule name |
Check the TLS version of an OSS bucket |
|
Rule identifier |
|
|
Tags |
OSS,TLS |
|
Automatic remediation |
Not supported |
|
Rule trigger |
Periodic |
|
Trigger frequency |
24 hours |
|
Supported resource types |
OSS bucket |
|
Rule input parameters |
tlsVersion |
Remediation
To remediate non-compliant resources, see Set the TLS version.