Homepage

AppSync cache data is not encrypted in transit Affecting AppSync service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption in Transit

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00756
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Unencrypted data in transit increases the risk of unauthorized access and data leakage in the AppSync cache. Ensure that data stored in the cache is encrypted in transit to protect sensitive information.

How to fix?

Set the transit_encryption_enabled attribute to true in the aws_appsync_api_cache resource.

Example Configuration

resource "aws_appsync_graphql_api" "allowed" {
  authentication_type = "API_KEY"
  name                = "allowed1"
}

resource "aws_appsync_api_cache" "allowed1" {
  api_id                     = aws_appsync_graphql_api.allowed.id
  api_caching_behavior       = "FULL_REQUEST_CACHING"
  type                       = "SMALL"
  ttl                        = 900
  at_rest_encryption_enabled = true
  transit_encryption_enabled = true
}