tag: Tls · 6 items
- Platform/SRE — Plan: MSK Provisioned clusters now support TLS 1.3 as a GA opt-in via named security policies — evaluate applying a TLS 1.3-capable policy this quarter, particularly if your org has compliance frameworks requiring TLS 1.3 or if post-quantum readiness is on the roadmap.
- CI/CD — Skip
- Leader — Learn: MSK’s new TLS 1.3 support is a step toward post-quantum cryptography readiness and aligns with tightening compliance standards; no strategic or licensing decision is forced, but worth knowing if your security policy roadmap includes post-quantum preparedness.
- Platform/SRE — Plan: CVE-2026-35189 fixes a remote DoS in TLS certificate parsing via BoringSSL; not KEV-listed and EPSS is near-zero, so no evidence of active exploitation — schedule an upgrade to v1.39.2 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14 · deprecation mentioned (no explicit date found) · CVE-2026-35189 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Learn: For teams operating Bedrock AgentCore workloads, this eliminates the need for an intermediate ALB when connecting to private VPC Lattice endpoints — worth evaluating if you’re building that architecture, but no change required to existing infrastructure.
- CI/CD — Skip
- Leader — Learn: AWS is deepening native private-network integration for Bedrock’s agent layer; useful context if your org is standardizing on AgentCore for AI agent workloads and evaluating VPC connectivity patterns, but no strategic decision is forced.
- Platform/SRE — Act: If your org uses GitHub Enterprise Cloud with data residency, audit any internal tooling, Terraform GitHub provider clients, or API automation that may negotiate TLS using only X25519 before October 7 — connections from those clients will break.
- CI/CD — Act: Verify that CI runners and pipeline scripts connecting to GHE.com with data residency use a TLS stack that offers multiple key-agreement algorithms, not X25519 exclusively; the hard cutoff is October 7, 2026.
- Leader — Skip
- Platform/SRE — Plan: SHA-1 HTTPS on GitHub is now enforced (2026-09-15); audit any infrastructure tooling—Terraform module fetches, Helm chart sources, custom operators—that connects to GitHub via HTTPS and update any clients running legacy TLS libraries before they surface connectivity failures.
- CI/CD — Act: Enforcement is live as of 2026-09-15—any runner image or build tool using an old TLS stack that negotiates SHA-1 for HTTPS connections to GitHub is already failing; audit runner images and git client versions immediately and update or replace those using legacy OpenSSL/TLS configurations.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Learn: New GA capability for end-to-end TLS on Azure Functions Flex Consumption; worth noting if your platform uses this hosting model, but no migration deadline or breaking change.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement