[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"content-guides-api-gateway-governance-tools":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":8,"contributorPaths":9,"menuType":11,"contentName":12,"slug":13,"readingTime":14,"menu":15,"nextDocItem":42,"previousDocItem":32},"\u003Cp>There are various tools you can use to implement security controls in AWS. This section focuses on some tools that are most relevant to Amazon API Gateway governance needs.\u003C\u002Fp>\n\u003Cp>The tools highlighted in this guide are AWS specific and some of them (especially proactive control tools) are specific to the Infrastructure as Code (IaC) tooling you use. For more information on some specific tools, see \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftfsec\">tfsec\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Fcloud-docs\u002Fpolicy-enforcement\">Terraform Cloud Policy Enforcement\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fusing-pulumi\u002Fcrossguard\u002Fget-started\u002F\">Pulumi CrossGuard\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>\u003Cstrong>AWS Identity and Access Management policies, permission boundaries (IAM)\u003C\u002Fstrong>\u003C\u002Fh3>\n\u003Cp>You control access in AWS by creating policies and attaching them to AWS identities or resources. A policy is an object in AWS that, when associated with an identity or resource, defines their permissions. AWS evaluates these policies when a principal (user or role session) makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.\nIn IAM, a \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Faccess_policies_boundaries.html\">permissions boundary\u003C\u002Fa> is used to set the maximum permissions that an identity-based policy can grant to an IAM entity (users or roles). An entity's permission boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permission boundaries. \u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>API Gateway \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity-iam.html\">documentation article\u003C\u002Fa> on how service uses IAM\u003C\u002Fli>\n\u003Cli>API Gateway \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html\">identity-based policy examples\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html\">List of IAM actions, resources, and condition keys\u003C\u002Fa> for API Gateway management\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Service control policies\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Forganizations\u002Flatest\u002Fuserguide\u002Forgs_manage_policies_scps.html\">Service control policies\u003C\u002Fa> (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for the IAM users and IAM roles in your organization. These policies help accounts stay within access control guidelines of the organization. \u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html\">List of IAM actions, resources, and condition keys\u003C\u002Fa> for API Gateway management that you can use while developing SCPs.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>AWS CloudFormation hooks\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAWSCloudFormation\u002Flatest\u002FUserGuide\u002FWelcome.html\">AWS CloudFormation\u003C\u002Fa> helps you set up AWS resources, provision them quickly and consistently, and manage them throughout their lifecycle across AWS accounts and Regions. \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcloudformation-cli\u002Flatest\u002Fuserguide\u002Fhooks.html\">CloudFormation hooks\u003C\u002Fa> proactively evaluate the configuration of your CloudFormation resources before they are deployed. If noncompliant resources are found, it returns a failure status. Based on the hook failure mode, CloudFormation can fail the operation or present a warning that allows the user to continue with the deployment. Use available hooks, or you can develop your own.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Check for the available hooks in \u003Ca href=\"https:\u002F\u002Fconsole.aws.amazon.com\u002Fcloudformation\u002Fhome?#\u002Fregistry\u002Fpublic-extensions\">CloudFormation Registry Public Extensions\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>See \u003Ca href=\"https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F3-proactive-config\">Proactive Controls with AWS Config\u003C\u002Fa> for more details on how to implement proactive controls with AWS Config and AWS CloudFormation hooks in CI\u002FCD pipelines\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>Note that this approach may not work if you use Infrastructure as Code deployment tools that do not use AWS CloudFormation.\u003C\u002Fem>\u003C\u002Fp>\n\u003Ch3>AWS Control Tower\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcontroltower\u002Flatest\u002Fuserguide\u002Fwhat-is-control-tower.html\">AWS Control Tower\u003C\u002Fa> helps you set up and govern an AWS multi-account environment, following prescriptive best practices. AWS Control Tower offers preconfigured \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcontroltower\u002Flatest\u002Fuserguide\u002Fproactive-controls.html\">proactive controls\u003C\u002Fa> that you can enable in your landing zone. If your landing zone is set up using AWS Control Tower, you can use these optional proactive controls as a starting point for your organization. You can build additional, custom proactive controls in CloudFormation as needed.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>See the \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcontroltower\u002Flatest\u002Fcontrolreference\u002Fapi-gateway-rules.html\">AWS Control Tower Controls Reference Guide\u003C\u002Fa> for API Gateway specific AWS Control Tower controls.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>Note that this approach may not work if you use Infrastructure as Code deployment mechanisms that do not involve AWS CloudFormation.\u003C\u002Fem>\u003C\u002Fp>\n\u003Ch3>\u003Cstrong>AWS CloudFormation Guard\u003C\u002Fstrong>\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fwhat-is-guard.html\">AWS CloudFormation Guard\u003C\u002Fa> is an open-source, general-purpose, policy-as-code evaluation tool. The Guard command line interface (CLI) provides a simple-to-use, yet powerful and expressive, declarative domain-specific language (DSL) that you can use to express policy as code. In addition, you can use CLI commands to validate structured hierarchical JSON or YAML data against those rules. Guard also provides a built-in unit testing framework to verify that your rules work as intended.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Faws-cloudformation\u002Faws-guard-rules-registry\u002Ftree\u002Fmain\u002Frules\u002Faws\u002Fapi_gateway\">Code repository\u003C\u002Fa> for managed rule set for API Gateway\u003C\u002Fli>\n\u003Cli>See \u003Ca href=\"https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F2-proactive-guard\">Proactive Controls with AWS CloudFormation Guard\u003C\u002Fa> for more details on how to implement proactive controls using AWS CloudFormation Guard\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>Note that this approach may not work if you use Infrastructure as Code deployment mechanisms that do not involve AWS CloudFormation.\u003C\u002Fem>\u003C\u002Fp>\n\u003Ch3>Amazon Macie,  Amazon CloudWatch data protection policies\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fmacie\u002Flatest\u002Fuser\u002Fwhat-is-macie.html\">Amazon Macie\u003C\u002Fa> is a fully managed data security and data privacy service that uses machine learning and pattern matching to help discover and protect sensitive data in AWS. \nYou can also help safeguard sensitive data that's ingested by CloudWatch Logs by using \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fmask-sensitive-log-data.html\">log group \u003Cem>data protection policies\u003C\u002Fem>\u003C\u002Fa>. These policies let you audit and mask sensitive data that appear in log events ingested by the log groups in your account.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-mapping-template-reference.html\">access logging variable reference\u003C\u002Fa> and consider Macie for discovering sensitive data in API Gateway access or execution logs stored in S3.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>AWS Config\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002FWhatIsConfig.html\">AWS Config\u003C\u002Fa> audits and records the compliance of AWS resources. AWS Config discovers existing AWS resources and generates a full inventory, along with the configuration details of each resource. If there are any configuration changes, it records those changes and provides notification. This can help you detect and roll back unauthorized infrastructure changes. You can use AWS managed rules and can create custom rules.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fmanaged-rules-by-aws-config.html\">AWS Config managed rules\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules.html\">documentation\u003C\u002Fa> on how to create custom rules. \u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Foperational-best-practices-for-amazon-API-gateway.html\">Operational Best Practices for Amazon API Gateway\u003C\u002Fa> conformance pack.\u003C\u002Fli>\n\u003Cli>See \u003Ca href=\"https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F3-proactive-config\">Proactive Controls with AWS Confige\u003C\u002Fa> for more details on how to implement proactive controls with AWS Config and AWS CloudFormation hooks in CI\u002FCD pipelines\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>AWS Trusted Advisor\u003C\u002Fh3>\n\u003Cp>You can use \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fawssupport\u002Flatest\u002Fuser\u002Ftrusted-advisor.html\">AWS Trusted Advisor\u003C\u002Fa> as a service for detective controls. Through a set of checks, Trusted Advisor identifies areas where you can optimize your infrastructure, improve performance and security, or reduce costs. Trusted Advisor provides recommendations based on AWS best practices that you can follow to improve your services and resources. Business and Enterprise Support plans provide access to all available checks for the \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fframework\u002Fthe-pillars-of-the-framework.html\">pillars\u003C\u002Fa> of the AWS Well-Architected Framework.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Additional information:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fawssupport\u002Flatest\u002Fuser\u002Ftrusted-advisor-check-reference.html\">AWS Trusted Advisor check reference\u003C\u002Fa> for the list of the checks specific to API Gateway\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>Amazon EventBridge\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Feventbridge\u002F\">Amazon EventBridge\u003C\u002Fa> is a serverless service that uses events to connect application components together, making it easier for developers to build scalable event-driven applications. As many AWS services generate events that EventBridge receives, in the default event bus, you can specify rules that react to those events based on your needs. For example, the following rule can send events to a Lambda function, specified as a target, every time stage \u003Ccode>prod\u003C\u002Fcode> of the REST API with ID \u003Ccode>abcd123456\u003C\u002Fcode> gets updated:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "detail": {\n    "eventSource": ["apigateway.amazonaws.com"],\n    "requestParameters": {\n      "restApiId": ["abcd123456"]\n    },\n    "responseElements": {\n      "stageName": ["prod"]\n    },\n    "eventName": ["UpdateStage"],\n    "errorCode": [{\n      "exists": false\n    }]\n  }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch3>Security Hub\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fsecurityhub\u002Flatest\u002Fuserguide\u002Fwhat-is-securityhub.html\">AWS Security Hub\u003C\u002Fa> automatically sends all new findings and all updates of existing findings to EventBridge as events. You can also create custom actions that send selected findings and insight results to EventBridge. You can configure EventBridge to respond to each type of event. The event can initiate an AWS Lambda function that performs the remediation action.\u003C\u002Fp>\n\u003Cp>You can tailor responses to those events based on your needs - use AWS SDK to review resource configuration after update, send a message to the group of recipients, take a corrective action, roll back a deployment, etc.\u003C\u002Fp>\n",{"title":6,"order":7},"Tools",3,"There are various tools you can use to implement security controls in AWS. This section focuses on some tools that are most relevant to Amazon API Gateway governance needs.\n\nThe tools highlighted in this guide are AWS specific and some of them (especially proactive control tools) are specific to the Infrastructure as Code (IaC) tooling you use. For more information on some specific tools, see [tfsec](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftfsec), [Terraform Cloud Policy Enforcement](https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Fcloud-docs\u002Fpolicy-enforcement), [Pulumi CrossGuard](https:\u002F\u002Fwww.pulumi.com\u002Fdocs\u002Fusing-pulumi\u002Fcrossguard\u002Fget-started\u002F).\n\n### **AWS Identity and Access Management policies, permission boundaries (IAM)**\n\nYou control access in AWS by creating policies and attaching them to AWS identities or resources. A policy is an object in AWS that, when associated with an identity or resource, defines their permissions. AWS evaluates these policies when a principal (user or role session) makes a request. Permissions in the policies determine whether the request is allowed or denied. Most policies are stored in AWS as JSON documents.\nIn IAM, a [permissions boundary](https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Faccess_policies_boundaries.html) is used to set the maximum permissions that an identity-based policy can grant to an IAM entity (users or roles). An entity's permission boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permission boundaries. \n\n**Additional information:**\n* API Gateway [documentation article](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity-iam.html) on how service uses IAM\n* API Gateway [identity-based policy examples](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html)\n* [List of IAM actions, resources, and condition keys](https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html) for API Gateway management\n\n### Service control policies\n\n[Service control policies](https:\u002F\u002Fdocs.aws.amazon.com\u002Forganizations\u002Flatest\u002Fuserguide\u002Forgs_manage_policies_scps.html) (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for the IAM users and IAM roles in your organization. These policies help accounts stay within access control guidelines of the organization. \n\n**Additional information:**\n* [List of IAM actions, resources, and condition keys](https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html) for API Gateway management that you can use while developing SCPs.\n\n### AWS CloudFormation hooks\n\n[AWS CloudFormation](https:\u002F\u002Fdocs.aws.amazon.com\u002FAWSCloudFormation\u002Flatest\u002FUserGuide\u002FWelcome.html) helps you set up AWS resources, provision them quickly and consistently, and manage them throughout their lifecycle across AWS accounts and Regions. [CloudFormation hooks](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcloudformation-cli\u002Flatest\u002Fuserguide\u002Fhooks.html) proactively evaluate the configuration of your CloudFormation resources before they are deployed. If noncompliant resources are found, it returns a failure status. Based on the hook failure mode, CloudFormation can fail the operation or present a warning that allows the user to continue with the deployment. Use available hooks, or you can develop your own.\n\n**Additional information:**\n* Check for the available hooks in [CloudFormation Registry Public Extensions](https:\u002F\u002Fconsole.aws.amazon.com\u002Fcloudformation\u002Fhome?#\u002Fregistry\u002Fpublic-extensions)\n* See [Proactive Controls with AWS Config](https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F3-proactive-config) for more details on how to implement proactive controls with AWS Config and AWS CloudFormation hooks in CI\u002FCD pipelines\n\n*Note that this approach may not work if you use Infrastructure as Code deployment tools that do not use AWS CloudFormation.*\n\n### AWS Control Tower\n\n[AWS Control Tower](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcontroltower\u002Flatest\u002Fuserguide\u002Fwhat-is-control-tower.html) helps you set up and govern an AWS multi-account environment, following prescriptive best practices. AWS Control Tower offers preconfigured [proactive controls](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcontroltower\u002Flatest\u002Fuserguide\u002Fproactive-controls.html) that you can enable in your landing zone. If your landing zone is set up using AWS Control Tower, you can use these optional proactive controls as a starting point for your organization. You can build additional, custom proactive controls in CloudFormation as needed.\n\n**Additional information:**\n* See the [AWS Control Tower Controls Reference Guide](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcontroltower\u002Flatest\u002Fcontrolreference\u002Fapi-gateway-rules.html) for API Gateway specific AWS Control Tower controls.\n\n*Note that this approach may not work if you use Infrastructure as Code deployment mechanisms that do not involve AWS CloudFormation.*\n\n### **AWS CloudFormation Guard**\n\n[AWS CloudFormation Guard](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fwhat-is-guard.html) is an open-source, general-purpose, policy-as-code evaluation tool. The Guard command line interface (CLI) provides a simple-to-use, yet powerful and expressive, declarative domain-specific language (DSL) that you can use to express policy as code. In addition, you can use CLI commands to validate structured hierarchical JSON or YAML data against those rules. Guard also provides a built-in unit testing framework to verify that your rules work as intended.\n\n**Additional information:**\n* [Code repository](https:\u002F\u002Fgithub.com\u002Faws-cloudformation\u002Faws-guard-rules-registry\u002Ftree\u002Fmain\u002Frules\u002Faws\u002Fapi_gateway) for managed rule set for API Gateway\n* See [Proactive Controls with AWS CloudFormation Guard](https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F2-proactive-guard) for more details on how to implement proactive controls using AWS CloudFormation Guard\n\n*Note that this approach may not work if you use Infrastructure as Code deployment mechanisms that do not involve AWS CloudFormation.*\n\n### Amazon Macie,  Amazon CloudWatch data protection policies\n\n[Amazon Macie](https:\u002F\u002Fdocs.aws.amazon.com\u002Fmacie\u002Flatest\u002Fuser\u002Fwhat-is-macie.html) is a fully managed data security and data privacy service that uses machine learning and pattern matching to help discover and protect sensitive data in AWS. \nYou can also help safeguard sensitive data that's ingested by CloudWatch Logs by using [log group *data protection policies*](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fmask-sensitive-log-data.html). These policies let you audit and mask sensitive data that appear in log events ingested by the log groups in your account.\n\n**Additional information:**\n* See [access logging variable reference](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-mapping-template-reference.html) and consider Macie for discovering sensitive data in API Gateway access or execution logs stored in S3. \n\n### AWS Config\n\n[AWS Config](https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002FWhatIsConfig.html) audits and records the compliance of AWS resources. AWS Config discovers existing AWS resources and generates a full inventory, along with the configuration details of each resource. If there are any configuration changes, it records those changes and provides notification. This can help you detect and roll back unauthorized infrastructure changes. You can use AWS managed rules and can create custom rules.\n\n**Additional information:**\n* [AWS Config managed rules](https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fmanaged-rules-by-aws-config.html) and [documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules.html) on how to create custom rules. \n* [Operational Best Practices for Amazon API Gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Foperational-best-practices-for-amazon-API-gateway.html) conformance pack.\n* See [Proactive Controls with AWS Confige](https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F3-proactive-config) for more details on how to implement proactive controls with AWS Config and AWS CloudFormation hooks in CI\u002FCD pipelines\n\n### AWS Trusted Advisor\n\nYou can use [AWS Trusted Advisor](https:\u002F\u002Fdocs.aws.amazon.com\u002Fawssupport\u002Flatest\u002Fuser\u002Ftrusted-advisor.html) as a service for detective controls. Through a set of checks, Trusted Advisor identifies areas where you can optimize your infrastructure, improve performance and security, or reduce costs. Trusted Advisor provides recommendations based on AWS best practices that you can follow to improve your services and resources. Business and Enterprise Support plans provide access to all available checks for the [pillars](https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fframework\u002Fthe-pillars-of-the-framework.html) of the AWS Well-Architected Framework.\n\n**Additional information:**\n* See [AWS Trusted Advisor check reference](https:\u002F\u002Fdocs.aws.amazon.com\u002Fawssupport\u002Flatest\u002Fuser\u002Ftrusted-advisor-check-reference.html) for the list of the checks specific to API Gateway\n\n### Amazon EventBridge \n\n[Amazon EventBridge](https:\u002F\u002Faws.amazon.com\u002Feventbridge\u002F) is a serverless service that uses events to connect application components together, making it easier for developers to build scalable event-driven applications. As many AWS services generate events that EventBridge receives, in the default event bus, you can specify rules that react to those events based on your needs. For example, the following rule can send events to a Lambda function, specified as a target, every time stage `prod` of the REST API with ID `abcd123456` gets updated:\n\n```json\n{\n  \"detail\": {\n    \"eventSource\": [\"apigateway.amazonaws.com\"],\n    \"requestParameters\": {\n      \"restApiId\": [\"abcd123456\"]\n    },\n    \"responseElements\": {\n      \"stageName\": [\"prod\"]\n    },\n    \"eventName\": [\"UpdateStage\"],\n    \"errorCode\": [{\n      \"exists\": false\n    }]\n  }\n}\n```\n\n### Security Hub\n\n[AWS Security Hub](https:\u002F\u002Fdocs.aws.amazon.com\u002Fsecurityhub\u002Flatest\u002Fuserguide\u002Fwhat-is-securityhub.html) automatically sends all new findings and all updates of existing findings to EventBridge as events. You can also create custom actions that send selected findings and insight results to EventBridge. You can configure EventBridge to respond to each type of event. The event can initiate an AWS Lambda function that performs the remediation action.\n\nYou can tailor responses to those events based on your needs - use AWS SDK to review resource configuration after update, send a message to the group of recipients, take a corrective action, roll back a deployment, etc.\n",[10],"content\u002Fcontributors\u002Fgiedrius-praspaliauskas.json","LIST","Amazon API Gateway governance in depth","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Ftools","7 min",[16,55,84],{"title":17,"content":18},"Amazon API Gateway governance",[19,32,39,42,49],{"title":20,"order":21,"authors":22,"callout":24,"time":28,"path":29,"id":30,"link":31},"Introduction",1,[23],"Giedrius Praspaliauskas",{"title":25,"description":26,"link":27},"Building an API platform on AWS","This guide summarizes the API lifecycle and provides an AWS point of view on building an API platform using Amazon API Gateway. It provides prescriptive guidance on 3rd party and AWS services to cover the end-to-end needs of the API lifecycle.","https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fintroduction","1 min","introduction","introduction.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fintroduction",{"title":33,"order":34,"time":35,"path":36,"id":37,"link":38},"Security controls",2,"2 min","controls","controls.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fcontrols",{"title":6,"order":7,"time":14,"path":40,"id":41,"link":13},"tools","tools.md",{"title":43,"order":44,"time":45,"path":46,"id":47,"link":48},"API management access control",4,"4 min","management_access","management_access.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement_access",{"title":50,"order":51,"time":28,"path":52,"id":53,"link":54},"API management audit",5,"audit_track","audit_track.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faudit_track",{"title":56,"content":57},"Use cases and examples",[58,64,71,78],{"title":59,"order":60,"time":28,"path":61,"id":62,"link":63},"Use-cases overview",6,"use_cases","use_cases.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fuse_cases",{"title":65,"order":66,"time":67,"path":68,"id":69,"link":70},"Enforcing observability for governance",8,"3 min","observability","observability.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fobservability",{"title":72,"order":73,"time":74,"path":75,"id":76,"link":77},"Enforcing security for governance",9,"5 min","access_control","access_control.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faccess_control",{"title":79,"order":80,"time":45,"path":81,"id":82,"link":83},"Enforcing management control",10,"management","management.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement",{"title":85,"content":86},"Summary",[87,93],{"title":88,"order":89,"time":28,"path":90,"id":91,"link":92},"Index of examples",11,"index","index.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Findex",{"title":94,"order":95,"time":28,"path":96,"id":97,"link":98},"Additional resources",12,"additional_resources","additional_resources.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fadditional_resources",1789814104159]