feat(apigateway): update domain name security policy

[Jojo134]

Issue # (if applicable)

Closes #36663

Reason for this change

The TLS_1_2 security policies are legacy. The policies starting with SecurityPolicy should be preferred this introduces the possibility to do this via CDK.

Description of changes

• Add the Security Policies to the Enum
• Make the endpointAccessMode configurable as required by the new policies

Describe any new or updated permissions being added

Description of how you validated changes

Note: unable to run the integ tests

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

[pahud]

Thanks for this PR @Jojo134!

The linked issue (#36663) also requests securityPolicy and endpointAccessMode on RestApi, not just DomainName. The CfnRestApi L1 supports both properties.

If you'd prefer to keep this PR scoped to DomainName, we can keep #36663 open for the RestApi portion.

[Jojo134]

Thanks for this PR @Jojo134!

The linked issue (#36663) also requests securityPolicy and endpointAccessMode on RestApi, not just DomainName. The CfnRestApi L1 supports both properties.

If you'd prefer to keep this PR scoped to DomainName, we can keep #36663 open for the RestApi portion.

I would give the implementation for the RestApi a shot.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[Jojo134]

Hey @pahud I implemented the changes also for the RestApi.

[aws-cdk-automation]

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

[aws-cdk-automation]

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.