[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"content-guides-api-gateway-governance-access_control":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":8,"contributorPaths":9,"menuType":11,"contentName":12,"slug":13,"readingTime":14,"menu":15,"nextDocItem":78,"previousDocItem":68},"\u003Cp>The following use case shows how to enforce access control for Amazon API Gateway governance using the following controls: \u003C\u002Fp>\n\u003Cul>\n\u003Cli>Require AWS WAF is enabled\u003C\u002Fli>\n\u003Cli>Require a client certificate for backend integrations\u003C\u002Fli>\n\u003Cli>Require a particular TLS version for a custom domain\u003C\u002Fli>\n\u003Cli>Require mTLS is enabled for all custom domains\u003C\u002Fli>\n\u003Cli>Require a particular type of authorizer\u003C\u002Fli>\n\u003Cli>Require a usage plan is associated with a resource\u003C\u002Fli>\n\u003Cli>Require API key to access a resource\u003C\u002Fli>\n\u003Cli>Require request validations, including specific headers\u003C\u002Fli>\n\u003Cli>Require only specific VPCs in the private API endpoint resource policy\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Require AWS WAF is enabled\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-aws-waf.html\">Using AWS WAF to protect your APIs\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. AWS Identity and Access Management (IAM) and service control policies (SCP) for API Gateway do not have conditions related to the Web ACLs.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cem>Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config rule - \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-associated-with-waf.html\">https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-associated-with-waf.html\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Require a client certificate for backend integrations\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fgetting-started-client-side-ssl-authentication.html\">Generate and configure an SSL certificate for backend authentication\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_GenerateClientCertificate.html\">Amazon API Gateway API Reference - GenerateClientCertificate\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative Controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCPs for API Gateway do not have conditions related to the Web ACLs.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cem>Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective Controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config rule - \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-ssl-enabled.html\">https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-ssl-enabled.html\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Require a particular TLS version for a custom domain\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-custom-domain-tls-version.html\">Choosing a security policy for your custom domain in API Gateway\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDomainName.html#apigw-CreateDomainName-request-securityPolicy\">Amazon API Gateway API Reference - CreateDomainName - securityPolicy\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>SCP that uses condition \u003Ccode>apigateway:Request\u002FSecurityPolicy\u003C\u002Fcode> to deny, for example, value \u003Ccode>TLS_1_0\u003C\u002Fcode> (which enforces TLS 1.2 or higher).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Require mTLS is enabled for all custom domains\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Frest-api-mutual-tls.html\">Configuring mutual TLS authentication for a REST API\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDomainName.html#apigw-CreateDomainName-request-mutualTlsAuthentication\">Amazon API Gateway API Reference - CreateDomainName - mutualTlsAuthentication\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative control\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>SCP applied to the accounts to enforce mTLS requiring that condition \u003Ccode>apigateway:Request\u002FMtlsTrustStoreUri\u003C\u002Fcode> value is present. Optionally, add \u003Ccode>MtlsTrustStoreVersion\u003C\u002Fcode> condition to enforce a particular version of the trust store in S3.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Require a particular type of authorizer\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-to-api.html\">Controlling and managing access to a REST API in API Gateway\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateAuthorizer.html\">Amazon API Gateway API Reference - CreateAuthorizer\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-require-authorization\">example in the documentation\u003C\u002Fa> that uses \u003Ccode>Request\u002FRouteAuthorizationType\u003C\u002Fcode> condition that allows developers to create APIs with JWT or REQUEST authorizers and adapt it as an SCP policy (change effect to deny, invert condition statement). Use \u003Ccode>apigateway:Request\u002FAuthorizerUr\u003C\u002Fcode>i in the condition to enforce a particular Lambda function as the authorizer.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Require a usage plan is associated with a resource\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-usage-plans.html\">Creating and using usage plans with API keys\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-request-throttling.html\">Throttle API requests for better throughput\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateUsagePlan.html\">Amazon API Gateway API Reference - CreateUsagePlan\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCP for API Gateway do not have conditions related to the \u003Ccode>UsagePlan\u003C\u002Fcode> resource. Condition key \u003Ccode>ApiKeyRequired\u003C\u002Fcode> does not enforce the requirement to have a usage plan associated with the resource, only an API key present in the request while accessing the resource.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Require API key to access a resource\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-usage-plans.html\">Creating and using usage plans with API keys\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateUsagePlan.html\">Amazon API Gateway API Reference - CreateUsagePlan\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>SCP policy with a condition key \u003Ccode>apigateway:Resource\u002FApiKeyRequired\u003C\u002Fcode> or \u003Ccode>apigateway:Request\u002FApiKeyRequired\u003C\u002Fcode> can be used to enforce requirement to include an API key while making a request to a particular resource\u002Fmethod, entire REST API, or all REST APIs in the organization\u002Faccount\u002Fregion.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Require request validations, including specific headers\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-method-request-validation.html\">Use request validation in API Gateway\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateRequestValidator.html\">Amazon API Gateway API Reference - CreateRequestValidator\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCP for API Gateway do not have conditions related to the \u003Ccode>RequestValidator\u003C\u002Fcode> resource.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Require only specific VPCs in the private API endpoint resource policy\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-endpoint-types.html#api-gateway-api-endpoint-types-private\">Choose an endpoint type for an API Gateway API - Private API endpoints\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-resource-policies-examples.html#apigateway-resource-policies-source-vpc-example\">API Gateway resource policy examples\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCP for API Gateway do not have conditions related to the resource policies.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n",{"title":6,"order":7},"Enforcing security for governance",9,"The following use case shows how to enforce access control for Amazon API Gateway governance using the following controls: \n* Require AWS WAF is enabled\n* Require a client certificate for backend integrations\n* Require a particular TLS version for a custom domain\n* Require mTLS is enabled for all custom domains\n* Require a particular type of authorizer\n* Require a usage plan is associated with a resource\n* Require API key to access a resource\n* Require request validations, including specific headers\n* Require only specific VPCs in the private API endpoint resource policy\n\n#### Require AWS WAF is enabled\n\n**Resources**\n- [Using AWS WAF to protect your APIs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-aws-waf.html)\n\n**Preventative controls**\n\nN\u002FA. AWS Identity and Access Management (IAM) and service control policies (SCP) for API Gateway do not have conditions related to the Web ACLs.\n\n**Proactive controls.**\n\nCustom AWS CloudFormation Hook.\n\n*Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.*\n\n**Detective controls**\n\nAWS Config rule - https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-associated-with-waf.html\n\n#### Require a client certificate for backend integrations\n\n**Resources**\n- [Generate and configure an SSL certificate for backend authentication](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fgetting-started-client-side-ssl-authentication.html)\n- [Amazon API Gateway API Reference - GenerateClientCertificate](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_GenerateClientCertificate.html)\n\n**Preventative Controls**\n\nN\u002FA. IAM and SCPs for API Gateway do not have conditions related to the Web ACLs.\n\n**Proactive controls**\n\nCustom AWS CloudFormation Hook.\n\n*Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.*\n\n**Detective Controls**\n\nAWS Config rule - https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-ssl-enabled.html\n\n#### Require a particular TLS version for a custom domain\n\n**Resources**\n- [Choosing a security policy for your custom domain in API Gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-custom-domain-tls-version.html)\n- [Amazon API Gateway API Reference - CreateDomainName - securityPolicy](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDomainName.html#apigw-CreateDomainName-request-securityPolicy)\n\n**Preventative controls**\n\nSCP that uses condition `apigateway:Request\u002FSecurityPolicy` to deny, for example, value `TLS_1_0` (which enforces TLS 1.2 or higher).\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Require mTLS is enabled for all custom domains\n\n**Resources**\n- [Configuring mutual TLS authentication for a REST API](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Frest-api-mutual-tls.html)\n- [Amazon API Gateway API Reference - CreateDomainName - mutualTlsAuthentication](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDomainName.html#apigw-CreateDomainName-request-mutualTlsAuthentication)\n\n**Preventative control**\n\nSCP applied to the accounts to enforce mTLS requiring that condition `apigateway:Request\u002FMtlsTrustStoreUri` value is present. Optionally, add `MtlsTrustStoreVersion` condition to enforce a particular version of the trust store in S3.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Require a particular type of authorizer\n\n**Resources**\n- [Controlling and managing access to a REST API in API Gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-to-api.html)\n- [Amazon API Gateway API Reference - CreateAuthorizer](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateAuthorizer.html)\n\n**Preventative controls**\n\nSee [example in the documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-require-authorization) that uses `Request\u002FRouteAuthorizationType` condition that allows developers to create APIs with JWT or REQUEST authorizers and adapt it as an SCP policy (change effect to deny, invert condition statement). Use `apigateway:Request\u002FAuthorizerUr`i in the condition to enforce a particular Lambda function as the authorizer.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Require a usage plan is associated with a resource\n\n**Resources**\n- [Creating and using usage plans with API keys](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-usage-plans.html)\n- [Throttle API requests for better throughput](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-request-throttling.html)\n- [Amazon API Gateway API Reference - CreateUsagePlan](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateUsagePlan.html)\n\n**Preventative controls**\n\nN\u002FA. IAM and SCP for API Gateway do not have conditions related to the `UsagePlan` resource. Condition key `ApiKeyRequired` does not enforce the requirement to have a usage plan associated with the resource, only an API key present in the request while accessing the resource.\n\n**Proactive controls**\n\nCustom AWS CloudFormation Hook.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Require API key to access a resource\n\n**Resources**\n- [Creating and using usage plans with API keys](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-usage-plans.html)\n- [Amazon API Gateway API Reference - CreateUsagePlan](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateUsagePlan.html)\n\n**Preventative controls**\n\nSCP policy with a condition key `apigateway:Resource\u002FApiKeyRequired` or `apigateway:Request\u002FApiKeyRequired` can be used to enforce requirement to include an API key while making a request to a particular resource\u002Fmethod, entire REST API, or all REST APIs in the organization\u002Faccount\u002Fregion.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Require request validations, including specific headers\n\n**Resources**\n- [Use request validation in API Gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-method-request-validation.html)\n- [Amazon API Gateway API Reference - CreateRequestValidator](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateRequestValidator.html)\n\n**Preventative controls**\n\nN\u002FA. IAM and SCP for API Gateway do not have conditions related to the `RequestValidator` resource.\n\n**Proactive controls**\n\nCustom AWS CloudFormation Hook.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Require only specific VPCs in the private API endpoint resource policy\n\n**Resources**\n- [Choose an endpoint type for an API Gateway API - Private API endpoints](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-endpoint-types.html#api-gateway-api-endpoint-types-private)\n- [API Gateway resource policy examples](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-resource-policies-examples.html#apigateway-resource-policies-source-vpc-example)\n\n**Preventative controls**\n\nN\u002FA. IAM and SCP for API Gateway do not have conditions related to the resource policies.\n\n**Proactive controls**\n\nCustom AWS CloudFormation Hook.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule",[10],"content\u002Fcontributors\u002Fgiedrius-praspaliauskas.json","LIST","Amazon API Gateway governance in depth","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faccess_control","5 min",[16,59,84],{"title":17,"content":18},"Amazon API Gateway governance",[19,32,39,46,53],{"title":20,"order":21,"authors":22,"callout":24,"time":28,"path":29,"id":30,"link":31},"Introduction",1,[23],"Giedrius Praspaliauskas",{"title":25,"description":26,"link":27},"Building an API platform on AWS","This guide summarizes the API lifecycle and provides an AWS point of view on building an API platform using Amazon API Gateway. It provides prescriptive guidance on 3rd party and AWS services to cover the end-to-end needs of the API lifecycle.","https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fintroduction","1 min","introduction","introduction.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fintroduction",{"title":33,"order":34,"time":35,"path":36,"id":37,"link":38},"Security controls",2,"2 min","controls","controls.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fcontrols",{"title":40,"order":41,"time":42,"path":43,"id":44,"link":45},"Tools",3,"7 min","tools","tools.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Ftools",{"title":47,"order":48,"time":49,"path":50,"id":51,"link":52},"API management access control",4,"4 min","management_access","management_access.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement_access",{"title":54,"order":55,"time":28,"path":56,"id":57,"link":58},"API management audit",5,"audit_track","audit_track.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faudit_track",{"title":60,"content":61},"Use cases and examples",[62,68,75,78],{"title":63,"order":64,"time":28,"path":65,"id":66,"link":67},"Use-cases overview",6,"use_cases","use_cases.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fuse_cases",{"title":69,"order":70,"time":71,"path":72,"id":73,"link":74},"Enforcing observability for governance",8,"3 min","observability","observability.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fobservability",{"title":6,"order":7,"time":14,"path":76,"id":77,"link":13},"access_control","access_control.md",{"title":79,"order":80,"time":49,"path":81,"id":82,"link":83},"Enforcing management control",10,"management","management.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement",{"title":85,"content":86},"Summary",[87,93],{"title":88,"order":89,"time":28,"path":90,"id":91,"link":92},"Index of examples",11,"index","index.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Findex",{"title":94,"order":95,"time":28,"path":96,"id":97,"link":98},"Additional resources",12,"additional_resources","additional_resources.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fadditional_resources",1792665263973]