There are various tools you can use to implement security controls in AWS. This section focuses on some tools that are most relevant to Amazon API Gateway governance needs.

The tools highlighted in this guide are AWS specific and some of them (especially proactive control tools) are specific to the Infrastructure as Code (IaC) tooling you use. For more information on some specific tools, see tfsec, Terraform Cloud Policy Enforcement, Pulumi CrossGuard.

AWS Identity and Access Management policies, permission boundaries (IAM)

You control access in AWS by creating policies and attaching them to AWS identities or resources. A policy is an object in AWS that, when associated with an identity or resource, defines their permissions. AWS evaluates these policies when a principal (user or role session) makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents. In IAM, a permissions boundary is used to set the maximum permissions that an identity-based policy can grant to an IAM entity (users or roles). An entity's permission boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permission boundaries.

Additional information:

• API Gateway documentation article on how service uses IAM
• API Gateway identity-based policy examples
• List of IAM actions, resources, and condition keys for API Gateway management

Service control policies

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for the IAM users and IAM roles in your organization. These policies help accounts stay within access control guidelines of the organization.

Additional information:

• List of IAM actions, resources, and condition keys for API Gateway management that you can use while developing SCPs.

AWS CloudFormation hooks

AWS CloudFormation helps you set up AWS resources, provision them quickly and consistently, and manage them throughout their lifecycle across AWS accounts and Regions. CloudFormation hooks proactively evaluate the configuration of your CloudFormation resources before they are deployed. If noncompliant resources are found, it returns a failure status. Based on the hook failure mode, CloudFormation can fail the operation or present a warning that allows the user to continue with the deployment. Use available hooks, or you can develop your own.

Additional information:

• Check for the available hooks in CloudFormation Registry Public Extensions
• See Proactive Controls with AWS Config for more details on how to implement proactive controls with AWS Config and AWS CloudFormation hooks in CI/CD pipelines

Note that this approach may not work if you use Infrastructure as Code deployment tools that do not use AWS CloudFormation.

AWS Control Tower

AWS Control Tower helps you set up and govern an AWS multi-account environment, following prescriptive best practices. AWS Control Tower offers preconfigured proactive controls that you can enable in your landing zone. If your landing zone is set up using AWS Control Tower, you can use these optional proactive controls as a starting point for your organization. You can build additional, custom proactive controls in CloudFormation as needed.

Additional information:

• See the AWS Control Tower Controls Reference Guide for API Gateway specific AWS Control Tower controls.

Note that this approach may not work if you use Infrastructure as Code deployment mechanisms that do not involve AWS CloudFormation.

AWS CloudFormation Guard

AWS CloudFormation Guard is an open-source, general-purpose, policy-as-code evaluation tool. The Guard command line interface (CLI) provides a simple-to-use, yet powerful and expressive, declarative domain-specific language (DSL) that you can use to express policy as code. In addition, you can use CLI commands to validate structured hierarchical JSON or YAML data against those rules. Guard also provides a built-in unit testing framework to verify that your rules work as intended.

Additional information:

• Code repository for managed rule set for API Gateway
• See Proactive Controls with AWS CloudFormation Guard for more details on how to implement proactive controls using AWS CloudFormation Guard

Note that this approach may not work if you use Infrastructure as Code deployment mechanisms that do not involve AWS CloudFormation.

Amazon Macie, Amazon CloudWatch data protection policies

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to help discover and protect sensitive data in AWS. You can also help safeguard sensitive data that's ingested by CloudWatch Logs by using log group data protection policies. These policies let you audit and mask sensitive data that appear in log events ingested by the log groups in your account.

Additional information:

• See access logging variable reference and consider Macie for discovering sensitive data in API Gateway access or execution logs stored in S3.

AWS Config

AWS Config audits and records the compliance of AWS resources. AWS Config discovers existing AWS resources and generates a full inventory, along with the configuration details of each resource. If there are any configuration changes, it records those changes and provides notification. This can help you detect and roll back unauthorized infrastructure changes. You can use AWS managed rules and can create custom rules.

Additional information:

• AWS Config managed rules and documentation on how to create custom rules.
• Operational Best Practices for Amazon API Gateway conformance pack.
• See Proactive Controls with AWS Confige for more details on how to implement proactive controls with AWS Config and AWS CloudFormation hooks in CI/CD pipelines

AWS Trusted Advisor

You can use AWS Trusted Advisor as a service for detective controls. Through a set of checks, Trusted Advisor identifies areas where you can optimize your infrastructure, improve performance and security, or reduce costs. Trusted Advisor provides recommendations based on AWS best practices that you can follow to improve your services and resources. Business and Enterprise Support plans provide access to all available checks for the pillars of the AWS Well-Architected Framework.

Additional information:

• See AWS Trusted Advisor check reference for the list of the checks specific to API Gateway

Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making it easier for developers to build scalable event-driven applications. As many AWS services generate events that EventBridge receives, in the default event bus, you can specify rules that react to those events based on your needs. For example, the following rule can send events to a Lambda function, specified as a target, every time stage prod of the REST API with ID abcd123456 gets updated:

{
  "detail": {
    "eventSource": ["apigateway.amazonaws.com"],
    "requestParameters": {
      "restApiId": ["abcd123456"]
    },
    "responseElements": {
      "stageName": ["prod"]
    },
    "eventName": ["UpdateStage"],
    "errorCode": [{
      "exists": false
    }]
  }
}

Security Hub

AWS Security Hub automatically sends all new findings and all updates of existing findings to EventBridge as events. You can also create custom actions that send selected findings and insight results to EventBridge. You can configure EventBridge to respond to each type of event. The event can initiate an AWS Lambda function that performs the remediation action.

You can tailor responses to those events based on your needs - use AWS SDK to review resource configuration after update, send a message to the group of recipients, take a corrective action, roll back a deployment, etc.