AWS API gateway request parameter is not validated misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_53
Category - Subcategory	Public Exposure - APIs
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	382a9838-eb65-4d34-a4ad-3f0fd0d795ab

Impact

This rule detects whether the AWS API Gateway has request validation enabled. Request validation is crucial for ensuring that the input parameters of each request to the API Gateway are properly validated, which helps prevent security vulnerabilities such as injection attacks and data breaches.

How to Fix

Resource: aws_api_gateway_method

• Arguments: request_validator_id

To fix this issue, add the request_validator_id argument to the aws_api_gateway_method resource in your Terraform code. This argument configures request validation settings for the API Gateway method. Make sure to specify the required input parameters and their validation requirements.

Secure code example:

The above code is secure based on the rule because it configures the request_validator_id argument in the aws_api_gateway_method resource. [source,go]

resource "aws_api_gateway_method" "MyDemoMethod" { rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id resource_id = aws_api_gateway_resource.MyDemoResource.id http_method = "GET" authorization = "NONE"

• request_validator_id = example.id }

---