Alibaba Cloud API Gateway API Protocol does not use HTTPS misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_21
Category - Subcategory	Public Exposure - APIs
Provider	ALIBABA_CLOUD
Severity	LOW
Framework	Terraform

Impact

This rule ensures that Alibaba Cloud API Gateway APIs are configured to only accept HTTPS traffic. HTTPS ensures that communications between the clients and the API Gateway are securely encrypted, protecting against potential eavesdropping and man-in-the-middle attacks.

Failing to enforce HTTPS can result in sensitive data being transmitted over unsecure connections, making it vulnerable to interception and tampering.

How to Fix

Resource: alicloud_api_gateway_api

• Attribute: request_config.protocol

To mitigate this issue, ensure that the protocol attribute in the request_config block of the alicloud_api_gateway_api resource is set to HTTPS.

Example: [source,go]

resource "alicloud_api_gateway_api" "example" { ...

request_config { ...

• protocol = "HTTPS" } }

---