Ensure that an API Key is required on a Method Request

Risk Level: High
Cloud Entity: Amazon API Gateway
CloudGuard Rule ID: D9.AWS.CRY.37
Category: Networking & Content Delivery

GSL LOGIC

ApiGateway should have resources contain-all [ (methods contain-all [ apiKeyRequired=true ]) or (methods isEmpty()) ] or  authorizers isEmpty() = false

REMEDIATION

From Portal
Follow the below steps to configure an API method to require an API key

1. Sign in to the AWS Management Console and open the API Gateway console at https://console.aws.amazon.com/apigateway/.
2. Choose a REST API.
3. In the API Gateway main navigation pane, choose Resources.
4. Under Resources, create a new method or choose an existing one.
5. Choose Method Request.
6. Under the Settings section, choose true for API Key Required.
7. Select the checkmark icon to save the settings.
8. Deploy or redeploy the API for the requirement to take effect.

Note: If the API Key Required option is set to false and you don't execute the previous steps, any API key that's associated with an API stage isn't used for the method.

From TF

resource "aws_api_gateway_method" "test" {
	rest_api_id       = aws_api_gateway_rest_api.testapi.id
	resource_id       = aws_api_gateway_resource.testapi.id
	http_method       = "GET" # HTTP methods of DELETE, GET, HEAD, OPTIONS, PATCH, POST, and PUT.
	authorization     = "NONE"
	+ api_key_required  = true
}

References

1. https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-setup-api-key-with-console.html
2. https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-create-api.html
3. https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-deploy-api.html
4. https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method

Amazon API Gateway

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. With a few clicks in the AWS Management Console, you can create REST and WebSocket APIs that act as a ���front door��� for applications to access data, business logic, or functionality from your backend services, such as workloads running on Amazon Elastic Compute Cloud (Amazon EC2), code running on AWS Lambda, any web application, or real-time communication a

Compliance Frameworks

• AWS CloudGuard Best Practices
• AWS CloudGuard SOC2 based on AICPA TSC 2017
• AWS CloudGuard Well Architected Framework
• AWS HITRUST
• AWS HITRUST v11.0.0
• AWS ITSG-33
• AWS MAS TRM Framework
• AWS MITRE ATT&CK Framework v10
• AWS MITRE ATT&CK Framework v11.3