The following use case shows how to enforce access control for Amazon API Gateway governance using the following controls:
- Require AWS WAF is enabled
- Require a client certificate for backend integrations
- Require a particular TLS version for a custom domain
- Require mTLS is enabled for all custom domains
- Require a particular type of authorizer
- Require a usage plan is associated with a resource
- Require API key to access a resource
- Require request validations, including specific headers
- Require only specific VPCs in the private API endpoint resource policy
Require AWS WAF is enabled
Resources
Preventative controls
N/A. AWS Identity and Access Management (IAM) and service control policies (SCP) for API Gateway do not have conditions related to the Web ACLs.
Proactive controls.
Custom AWS CloudFormation Hook.
Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.
Detective controls
AWS Config rule - https://docs.aws.amazon.com/config/latest/developerguide/api-gw-associated-with-waf.html
Require a client certificate for backend integrations
Resources
- Generate and configure an SSL certificate for backend authentication
- Amazon API Gateway API Reference - GenerateClientCertificate
Preventative Controls
N/A. IAM and SCPs for API Gateway do not have conditions related to the Web ACLs.
Proactive controls
Custom AWS CloudFormation Hook.
Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.
Detective Controls
AWS Config rule - https://docs.aws.amazon.com/config/latest/developerguide/api-gw-ssl-enabled.html
Require a particular TLS version for a custom domain
Resources
- Choosing a security policy for your custom domain in API Gateway
- Amazon API Gateway API Reference - CreateDomainName - securityPolicy
Preventative controls
SCP that uses condition apigateway:Request/SecurityPolicy to deny, for example, value TLS_1_0 (which enforces TLS 1.2 or higher).
Detective controls
Amazon EventBridge rule or AWS Config custom AWS Lambda rule
Require mTLS is enabled for all custom domains
Resources
- Configuring mutual TLS authentication for a REST API
- Amazon API Gateway API Reference - CreateDomainName - mutualTlsAuthentication
Preventative control
SCP applied to the accounts to enforce mTLS requiring that condition apigateway:Request/MtlsTrustStoreUri value is present. Optionally, add MtlsTrustStoreVersion condition to enforce a particular version of the trust store in S3.
Detective controls
Amazon EventBridge rule or AWS Config custom AWS Lambda rule
Require a particular type of authorizer
Resources
- Controlling and managing access to a REST API in API Gateway
- Amazon API Gateway API Reference - CreateAuthorizer
Preventative controls
See example in the documentation that uses Request/RouteAuthorizationType condition that allows developers to create APIs with JWT or REQUEST authorizers and adapt it as an SCP policy (change effect to deny, invert condition statement). Use apigateway:Request/AuthorizerUri in the condition to enforce a particular Lambda function as the authorizer.
Detective controls
Amazon EventBridge rule or AWS Config custom AWS Lambda rule
Require a usage plan is associated with a resource
Resources
- Creating and using usage plans with API keys
- Throttle API requests for better throughput
- Amazon API Gateway API Reference - CreateUsagePlan
Preventative controls
N/A. IAM and SCP for API Gateway do not have conditions related to the UsagePlan resource. Condition key ApiKeyRequired does not enforce the requirement to have a usage plan associated with the resource, only an API key present in the request while accessing the resource.
Proactive controls
Custom AWS CloudFormation Hook.
Detective controls
Amazon EventBridge rule or AWS Config custom AWS Lambda rule
Require API key to access a resource
Resources
Preventative controls
SCP policy with a condition key apigateway:Resource/ApiKeyRequired or apigateway:Request/ApiKeyRequired can be used to enforce requirement to include an API key while making a request to a particular resource/method, entire REST API, or all REST APIs in the organization/account/region.
Detective controls
Amazon EventBridge rule or AWS Config custom AWS Lambda rule
Require request validations, including specific headers
Resources
Preventative controls
N/A. IAM and SCP for API Gateway do not have conditions related to the RequestValidator resource.
Proactive controls
Custom AWS CloudFormation Hook.
Detective controls
Amazon EventBridge rule or AWS Config custom AWS Lambda rule
Require only specific VPCs in the private API endpoint resource policy
Resources
- Choose an endpoint type for an API Gateway API - Private API endpoints
- API Gateway resource policy examples
Preventative controls
N/A. IAM and SCP for API Gateway do not have conditions related to the resource policies.
Proactive controls
Custom AWS CloudFormation Hook.
Detective controls
Amazon EventBridge rule or AWS Config custom AWS Lambda rule
Created by:
