Homepage
About Snyk

API Gateway should require API key for access Affecting API Gateway (REST APIs) service in AWS

Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    IAM / Access Control

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
  • Snyk ID SNYK-CC-00733
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Not enforcing the use of API keys for accessing the API Gateway could increase the risk of unauthorized access and potential abuse of the API.

How to fix?

Set the key_id attribute in aws_api_gateway_usage_plan_key resource to a valid key id.

Example Configuration


resource "aws_api_gateway_rest_api" "api733" {
  body = jsonencode({
    openapi = "3.0.1"
    info = {
      title   = "example"
      version = "1.0"
    }
    paths = {
      "/path1" = {
        get = {
          x-amazon-apigateway-integration = {
            httpMethod           = "GET"
            payloadFormatVersion = "1.0"
            type                 = "HTTP_PROXY"
            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
          }
        }
      }
    }
  })
  name = "API733"
}

resource "aws_api_gateway_api_key" "api_key_733" {
  name    = "APIKey733"
  enabled = true
}

resource "aws_api_gateway_deployment" "dep_733" {
  rest_api_id = aws_api_gateway_rest_api.api733.id
}

resource "aws_api_gateway_stage" "stage733" {
  deployment_id = aws_api_gateway_deployment.dep_733.id
  rest_api_id   = aws_api_gateway_rest_api.api733.id
  stage_name    = "stage733"
}

resource "aws_api_gateway_usage_plan" "usage_plan_733" {
  name = "UsagePlan733"

  api_stages {
    api_id = aws_api_gateway_rest_api.api733.id
    stage  = aws_api_gateway_stage.stage733.stage_name
  }
}

resource "aws_api_gateway_usage_plan_key" "usage_plan_key_733" {
  key_id        = aws_api_gateway_api_key.api_key_733.id
  key_type      = "API_KEY"
  usage_plan_id = aws_api_gateway_usage_plan.usage_plan_733.id
}