AWS API gateway methods are publicly accessible misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_59
Category - Subcategory	Public Exposure - APIs
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

AWS API gateway methods are by default publicly accessible. All of the methods configured as part of the API should be protected by an Authorizer or an API key. Unprotected API's can lead to data leaks and security breaches. We recommend you configure a custom authorizer OR an API key for every method in the API Gateway.

How to Fix

Resource: AWS::ApiGateway::Method

• Arguments: Properties.HttpMethod / Properties.AuthorizationType / Properties.ApiKeyRequired

[source,go]

Resources: ProtectedExample1: Type: 'AWS::ApiGateway::Method' Properties: ...

• HttpMethod: OPTIONS AuthorizationType: NONE ...

ProtectedExample2: Type: 'AWS::ApiGateway::Method' Properties: ... HttpMethod: GET AuthorizationType: NONE

• ApiKeyRequired: true ...

ProtectedExample3: Type: 'AWS::ApiGateway::Method' Properties: ... HttpMethod: GET

• AuthorizationType: AWS_IAM # or other valid authorization types ...

---