AWS AppSync is not protected by WAF misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_33
Category - Subcategory	Public Exposure - APIs
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform, Terraform Plan

Impact

Ensuring that your AWS AppSync API is protected by a Web Application Firewall (WAF) can help to improve the security of your API by protecting against common web vulnerabilities such as SQL injection attacks and cross-site scripting (XSS) attacks by inspecting incoming requests and blocking those that contain malicious payloads. It can also help to prevent DDoS attacks by allowing you to set rate-based rules that limit the number of requests that an IP address can send to your API within a specified time period.

How to Fix

To mitigate this issue, ensure that aws_appsync_graphql_api are connected with aws_wafv2_web_acl_association resources.

To fix this issue, ensure that your AWS AppSync GraphQL API is associated with an AWS WAFv2 WebACL. You can use the AWS::WAFv2::WebACLAssociation resource to create this association.

Example: [source,go]

resource "aws_appsync_graphql_api" "pass" { authentication_type = "API_KEY" name = "example" }

resource "aws_wafv2_web_acl_association" "pass" { resource_arn = aws_appsync_graphql_api.pass.arn web_acl_arn = aws_wafv2_web_acl.example.arn }

Resources: GoodAppSyncGraphQLApi: Type: "AWS::AppSync::GraphQLApi" Properties: ... GoodWAFv2WebACL: Type: "AWS::WAFv2::WebACL" Properties: ... WebACLAssociation: Type: AWS::WAFv2::WebACLAssociation Properties: ResourceArn: !GetAtt GoodAppSyncGraphQLApi.Arn WebACLArn: !GetAtt GoodWAFv2WebACL.Arn