API Gateway should require API key for access Affecting API Gateway (REST APIs) service in AWS


Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
IAM/ Access Control

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00733
  • creditSnyk Research Team

Description

Not enforcing the use of API keys for accessing the API Gateway could increase the risk of unauthorized access and potential abuse of the API.

How to fix?

Set the key_id attribute in aws_api_gateway_usage_plan_key resource to a valid key id.

Example Configuration


resource "aws_api_gateway_rest_api" "api733" {
  body = jsonencode({
    openapi = "3.0.1"
    info = {
      title   = "example"
      version = "1.0"
    }
    paths = {
      "/path1" = {
        get = {
          x-amazon-apigateway-integration = {
            httpMethod           = "GET"
            payloadFormatVersion = "1.0"
            type                 = "HTTP_PROXY"
            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
          }
        }
      }
    }
  })
  name = "API733"
}

resource "aws_api_gateway_api_key" "api_key_733" {
  name    = "APIKey733"
  enabled = true
}

resource "aws_api_gateway_deployment" "dep_733" {
  rest_api_id = aws_api_gateway_rest_api.api733.id
}

resource "aws_api_gateway_stage" "stage733" {
  deployment_id = aws_api_gateway_deployment.dep_733.id
  rest_api_id   = aws_api_gateway_rest_api.api733.id
  stage_name    = "stage733"
}

resource "aws_api_gateway_usage_plan" "usage_plan_733" {
  name = "UsagePlan733"

  api_stages {
    api_id = aws_api_gateway_rest_api.api733.id
    stage  = aws_api_gateway_stage.stage733.stage_name
  }
}

resource "aws_api_gateway_usage_plan_key" "usage_plan_key_733" {
  key_id        = aws_api_gateway_api_key.api_key_733.id
  key_type      = "API_KEY"
  usage_plan_id = aws_api_gateway_usage_plan.usage_plan_733.id
}