[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"content-guides-api-gateway-governance-management":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":8,"contributorPaths":9,"menuType":11,"contentName":12,"slug":13,"readingTime":14,"menu":15,"nextDocItem":87,"previousDocItem":74},"\u003Cp>The following use case shows how to enforce management control for Amazon API Gateway governance using the following controls: \u003C\u002Fp>\n\u003Cul>\n\u003Cli>Freeze API modifications based on a tag\u003C\u002Fli>\n\u003Cli>Prevent custom domains in child accounts (enforce central API service account)\u003C\u002Fli>\n\u003Cli>Prevent public APIs in accounts other than the central API\u002Fservice account\u003C\u002Fli>\n\u003Cli>Require all resources to have tags\u003C\u002Fli>\n\u003Cli>Require error responses to have custom messages\u003C\u002Fli>\n\u003Cli>Require API has documentation\u003C\u002Fli>\n\u003Cli>Require response payload compression is enabled\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Freeze API modifications based on a tag\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Use a service control policy (SCP) with condition key \u003Ccode>aws:ResourceTag\u002F${TagKey}\u003C\u002Fcode> to enforce this requirement. This policy does not allow changing a tag value that was used to freeze the resource in the first place. To lift the freeze, the AWS Identity and Access Management (IAM) policy must be be temporarily disabled or modified to include exceptions. The following example prevents any actions on an API Gateway resources with tag \u003Ccode>EnvironmentState\u003C\u002Fcode> value \u003Ccode>frozen\u003C\u002Fcode>.\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "Statement1",\n      "Effect": "Deny",\n      "Action": [\n        "apigateway:DELETE",\n        "apigateway:PATCH",\n        "apigateway:POST",\n        "apigateway:PUT"\n      ],\n      "Resource": "*",\n      "Condition":{\n      "StringEquals":{"aws:ResourceTag\u002FEnvironmentState": "frozen"}\n      }\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cem>Note: As an alternative, consider freezing deployments based on a stage name. For example, deny all deployments to a particular stage using condition \u003Ccode>apigateway:Request\u002FStageName.\u003C\u002Fcode>\u003C\u002Fem>.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Prevent custom domains in child accounts (enforce central API service account)\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Context\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhow-to-custom-domains.html\">Setting up custom domain names for REST APIs\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDomainName.html\">Amazon API Gateway API Reference - CreateDomainName\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Farchitecting-multiple-microservices-behind-a-single-domain-with-amazon-api-gateway\u002F\">Architecting multiple microservices behind a single domain with Amazon API Gateway\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>Note: Can use approach to prevent public APIs in child accounts as described later in this section, or in combination with this one.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>SCP that prevents any actions on a \u003Ccode>DomainName\u003C\u002Fcode> resource in child accounts can be used to enforce this requirement. For example, the following policy prevents creating new or updating existing domain names:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "Statement1",\n      "Effect": "Deny",\n      "Action": [\n        "apigateway:PUT",\n        "apigateway:PATCH",\n        "apigateway:POST"\n      ],\n      "Resource": [\n        "arn:aws:apigateway:*::\u002Fdomainnames",\n        "arn:aws:apigateway:*::\u002Fdomainnames\u002F*"\n      ]\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Prevent public APIs in accounts other than the central API\u002Fservice account\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Context\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-endpoint-types.html\">Choose an endpoint type for an API Gateway API\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>SCP to be applied to the accounts other than central API\u002Fservice account that requires condition \u003Ccode>apigateway:Request\u002FEndpointType\u003C\u002Fcode> to have value \u003Ccode>EDGE\u003C\u002Fcode> or \u003Ccode>REGIONAL\u003C\u002Fcode>. See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-private-api\">example IAM policy in documentation\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config rule - \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-endpoint-type-check.html\">https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-endpoint-type-check.html\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Require all resources to have tags\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Context\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-tagging.html\">Tagging your API Gateway resources\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Forganizations\u002Flatest\u002Fuserguide\u002Forgs_manage_policies_tag-policies.html\">Tag policies\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>SCP that uses condition \u003Ccode>aws:ResourceTag\u003C\u002Fcode> and prevents any actions on any API Gateway resource that does not have a tag with a particular name and, optionally, a value that can be used to enforce this requirement. \nFor example, the following policy denies all create\u002Fedit actions on API Gateway if tag \u003Ccode>owner\u003C\u002Fcode> is missing:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n    "Version": "2012-10-17",\n    "Statement": [\n        {\n            "Sid": "Statement1",\n            "Effect": "Deny",\n            "Action": [\n                "apigateway:PATCH",\n                "apigateway:POST",\n                "apigateway:PUT"\n            ],\n            "Resource": [\n                "arn:aws:apigateway:*::\u002Frestapis\u002F*"\n            ],\n            "Condition": {\n                "Null": {\n                    "aws:ResourceTag\u002Fowner": "true"\n                }\n            }\n        }\n    ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Note that child resources of \u003Ccode>RestApi\u003C\u002Fcode>, \u003Ccode>DomainName\u003C\u002Fcode>, and\u003Ccode> UsagePlan\u003C\u002Fcode> inherit tags of the parent.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom lambda rule\u003C\u002Fp>\n\u003Cp>As an alternative, you can use AWS Organizations \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Forganizations\u002Flatest\u002Fuserguide\u002Forgs_manage_policies_tag-policies.html\">tag policies\u003C\u002Fa> that allow you to maintain consistent tags, including the preferred case treatment of tag keys and tag values.\u003C\u002Fp>\n\u003Ch4>Require error responses to have custom messages\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Context\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-gatewayResponse-definition.html\">Gateway responses in API Gateway\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_MethodResponse.html#apigw-Type-MethodResponse-responseModels\">Amazon API Gateway API Reference - MethodResponse - responseModels\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCPs for API Gateway do not have conditions related to the \u003Ccode>MethodResponse\u003C\u002Fcode> resource.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Amazon EventBridge rule or AWS Config custom AWS Lambda rule\u003C\u002Fp>\n\u003Ch4>Require API to have documentation\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Context\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-documenting-api.html\">Documenting REST APIs\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDocumentationPart.html\">Amazon API Gateway API Reference - CreateDocumentationPart\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDocumentationVersion.html\">Amazon API Gateway API Reference - CreateDocumentationVersion\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCPs for API Gateway do not have conditions related to the \u003Ccode>DocumentationPart\u003C\u002Fcode> or \u003Ccode>DocumentationVersion\u003C\u002Fcode> resources.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config custom rule \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules_cfn-guard.html\">using Guard\u003C\u002Fa>, enabled for all \u003Ccode>AWS::ApiGateway::Stage\u003C\u002Fcode> resources:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>rule apigw_documentation_present_check when\n    resourceType == "AWS::ApiGateway::Stage"\n    {\n        configuration.documentationVersion is_string\n    }\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Require response payload compression is enabled\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Context\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-gzip-compression-decompression.html\">Enabling payload compression for an API\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateRestApi.html#apigw-CreateRestApi-request-minimumCompressionSize\">Amazon API Gateway API Reference - CreateRestApi - minimumCompressionSize\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCPs for API Gateway do not have compression related conditions for the \u003Ccode>RestApi\u003C\u002Fcode> resource\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config custom rule \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules_cfn-guard.html\">using Guard\u003C\u002Fa>, enabled for all \u003Ccode>AWS::ApiGateway::RestApi\u003C\u002Fcode> resources:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>rule apigw_compression_enabled_check when\n    resourceType == "AWS::ApiGateway::RestApi"\n    {\n        configuration.minimumCompressionSize >= 0\n    }\n\u003C\u002Fcode>\u003C\u002Fpre>\n",{"title":6,"order":7},"Enforcing management control",10,"The following use case shows how to enforce management control for Amazon API Gateway governance using the following controls: \n* Freeze API modifications based on a tag\n* Prevent custom domains in child accounts (enforce central API service account)\n* Prevent public APIs in accounts other than the central API\u002Fservice account\n* Require all resources to have tags\n* Require error responses to have custom messages\n* Require API has documentation\n* Require response payload compression is enabled\n\n#### Freeze API modifications based on a tag\n\n**Preventative controls**\n\nUse a service control policy (SCP) with condition key `aws:ResourceTag\u002F${TagKey}` to enforce this requirement. This policy does not allow changing a tag value that was used to freeze the resource in the first place. To lift the freeze, the AWS Identity and Access Management (IAM) policy must be be temporarily disabled or modified to include exceptions. The following example prevents any actions on an API Gateway resources with tag `EnvironmentState` value `frozen`.\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"Statement1\",\n      \"Effect\": \"Deny\",\n      \"Action\": [\n        \"apigateway:DELETE\",\n        \"apigateway:PATCH\",\n        \"apigateway:POST\",\n        \"apigateway:PUT\"\n      ],\n      \"Resource\": \"*\",\n      \"Condition\":{\n      \"StringEquals\":{\"aws:ResourceTag\u002FEnvironmentState\": \"frozen\"}\n      }\n    }\n  ]\n}\n```\n\n*Note: As an alternative, consider freezing deployments based on a stage name. For example, deny all deployments to a particular stage using condition `apigateway:Request\u002FStageName.`*.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Prevent custom domains in child accounts (enforce central API service account)\n\n**Context**\n- [Setting up custom domain names for REST APIs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhow-to-custom-domains.html)\n- [Amazon API Gateway API Reference - CreateDomainName](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDomainName.html)\n- [Architecting multiple microservices behind a single domain with Amazon API Gateway](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Farchitecting-multiple-microservices-behind-a-single-domain-with-amazon-api-gateway\u002F)\n\n*Note: Can use approach to prevent public APIs in child accounts as described later in this section, or in combination with this one.*\n\n**Preventative controls**\n\nSCP that prevents any actions on a `DomainName` resource in child accounts can be used to enforce this requirement. For example, the following policy prevents creating new or updating existing domain names:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"Statement1\",\n      \"Effect\": \"Deny\",\n      \"Action\": [\n        \"apigateway:PUT\",\n        \"apigateway:PATCH\",\n        \"apigateway:POST\"\n      ],\n      \"Resource\": [\n        \"arn:aws:apigateway:*::\u002Fdomainnames\",\n        \"arn:aws:apigateway:*::\u002Fdomainnames\u002F*\"\n      ]\n    }\n  ]\n}\n```\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Prevent public APIs in accounts other than the central API\u002Fservice account\n\n**Context**\n- [Choose an endpoint type for an API Gateway API](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-api-endpoint-types.html)\n\n**Preventative controls**\n\nSCP to be applied to the accounts other than central API\u002Fservice account that requires condition `apigateway:Request\u002FEndpointType` to have value `EDGE` or `REGIONAL`. See [example IAM policy in documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-private-api).\n\n**Detective controls**\n\nAWS Config rule - https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-endpoint-type-check.html\n\n#### Require all resources to have tags\n\n**Context**\n- [Tagging your API Gateway resources](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-tagging.html)\n- [Tag policies](https:\u002F\u002Fdocs.aws.amazon.com\u002Forganizations\u002Flatest\u002Fuserguide\u002Forgs_manage_policies_tag-policies.html)\n\n**Preventative controls**\n\nSCP that uses condition `aws:ResourceTag` and prevents any actions on any API Gateway resource that does not have a tag with a particular name and, optionally, a value that can be used to enforce this requirement. \nFor example, the following policy denies all create\u002Fedit actions on API Gateway if tag `owner` is missing:\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Statement1\",\n            \"Effect\": \"Deny\",\n            \"Action\": [\n                \"apigateway:PATCH\",\n                \"apigateway:POST\",\n                \"apigateway:PUT\"\n            ],\n            \"Resource\": [\n                \"arn:aws:apigateway:*::\u002Frestapis\u002F*\"\n            ],\n            \"Condition\": {\n                \"Null\": {\n                    \"aws:ResourceTag\u002Fowner\": \"true\"\n                }\n            }\n        }\n    ]\n}\n```\n\n\nNote that child resources of `RestApi`, `DomainName`, and` UsagePlan` inherit tags of the parent.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom lambda rule\n\nAs an alternative, you can use AWS Organizations [tag policies](https:\u002F\u002Fdocs.aws.amazon.com\u002Forganizations\u002Flatest\u002Fuserguide\u002Forgs_manage_policies_tag-policies.html) that allow you to maintain consistent tags, including the preferred case treatment of tag keys and tag values.\n\n#### Require error responses to have custom messages\n\n**Context**\n- [Gateway responses in API Gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-gatewayResponse-definition.html)\n- [Amazon API Gateway API Reference - MethodResponse - responseModels](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_MethodResponse.html#apigw-Type-MethodResponse-responseModels)\n\n**Preventative controls**\n\nN\u002FA. IAM and SCPs for API Gateway do not have conditions related to the `MethodResponse` resource.\n\n**Detective controls**\n\nAmazon EventBridge rule or AWS Config custom AWS Lambda rule\n\n#### Require API to have documentation\n\n**Context**\n- [Documenting REST APIs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-documenting-api.html)\n- [Amazon API Gateway API Reference - CreateDocumentationPart](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDocumentationPart.html)\n- [Amazon API Gateway API Reference - CreateDocumentationVersion](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateDocumentationVersion.html)\n\n**Preventative controls**\n\nN\u002FA. IAM and SCPs for API Gateway do not have conditions related to the `DocumentationPart` or `DocumentationVersion` resources.\n\n**Proactive controls**\n\nCustom AWS CloudFormation Hook.\n\n**Detective controls**\n\nAWS Config custom rule [using Guard](https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules_cfn-guard.html), enabled for all `AWS::ApiGateway::Stage` resources:\n\n```\nrule apigw_documentation_present_check when\n    resourceType == \"AWS::ApiGateway::Stage\"\n    {\n        configuration.documentationVersion is_string\n    }\n```\n\n#### Require response payload compression is enabled\n\n**Context**\n- [Enabling payload compression for an API](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-gzip-compression-decompression.html)\n- [Amazon API Gateway API Reference - CreateRestApi - minimumCompressionSize](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateRestApi.html#apigw-CreateRestApi-request-minimumCompressionSize)\n\n**Preventative controls**\n\nN\u002FA. IAM and SCPs for API Gateway do not have compression related conditions for the `RestApi` resource\n\n**Proactive controls**\n\nCustom AWS CloudFormation Hook.\n\n**Detective controls**\n\nAWS Config custom rule [using Guard](https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules_cfn-guard.html), enabled for all `AWS::ApiGateway::RestApi` resources:\n\n```\nrule apigw_compression_enabled_check when\n    resourceType == \"AWS::ApiGateway::RestApi\"\n    {\n        configuration.minimumCompressionSize >= 0\n    }\n```\n",[10],"content\u002Fcontributors\u002Fgiedrius-praspaliauskas.json","LIST","Amazon API Gateway governance in depth","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement","4 min",[16,58,84],{"title":17,"content":18},"Amazon API Gateway governance",[19,32,39,46,52],{"title":20,"order":21,"authors":22,"callout":24,"time":28,"path":29,"id":30,"link":31},"Introduction",1,[23],"Giedrius Praspaliauskas",{"title":25,"description":26,"link":27},"Building an API platform on AWS","This guide summarizes the API lifecycle and provides an AWS point of view on building an API platform using Amazon API Gateway. It provides prescriptive guidance on 3rd party and AWS services to cover the end-to-end needs of the API lifecycle.","https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fintroduction","1 min","introduction","introduction.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fintroduction",{"title":33,"order":34,"time":35,"path":36,"id":37,"link":38},"Security controls",2,"2 min","controls","controls.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fcontrols",{"title":40,"order":41,"time":42,"path":43,"id":44,"link":45},"Tools",3,"7 min","tools","tools.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Ftools",{"title":47,"order":48,"time":14,"path":49,"id":50,"link":51},"API management access control",4,"management_access","management_access.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement_access",{"title":53,"order":54,"time":28,"path":55,"id":56,"link":57},"API management audit",5,"audit_track","audit_track.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faudit_track",{"title":59,"content":60},"Use cases and examples",[61,67,74,81],{"title":62,"order":63,"time":28,"path":64,"id":65,"link":66},"Use-cases overview",6,"use_cases","use_cases.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fuse_cases",{"title":68,"order":69,"time":70,"path":71,"id":72,"link":73},"Enforcing observability for governance",8,"3 min","observability","observability.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fobservability",{"title":75,"order":76,"time":77,"path":78,"id":79,"link":80},"Enforcing security for governance",9,"5 min","access_control","access_control.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faccess_control",{"title":6,"order":7,"time":14,"path":82,"id":83,"link":13},"management","management.md",{"title":85,"content":86},"Summary",[87,93],{"title":88,"order":89,"time":28,"path":90,"id":91,"link":92},"Index of examples",11,"index","index.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Findex",{"title":94,"order":95,"time":28,"path":96,"id":97,"link":98},"Additional resources",12,"additional_resources","additional_resources.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fadditional_resources",1792578865375]