Project: KICS (Provisioning / Security & Compliance)
File: b16cdb37-ce15-4ab2-8401-d42b05d123fc.md

title: API Gateway Without Configured Authorizer hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: b16cdb37-ce15-4ab2-8401-d42b05d123fc Query name: API Gateway Without Configured Authorizer Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: API Gateway REST API should have an API Gateway Authorizer<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3" name: Setup AWS API Gateway setup on AWS and deploy API definition community.aws.awsapigateway: swagger_dict: { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "email": "user@gmail.com" }, }, "components": { "securitySchemes": { "requestauthorizersingle_stagevar": { "type": "apiKey", "name": "Unused", "in": "header", "x-amazon-apigateway-authtype": "custom", }, }, }, } stage: production cache_enabled: true cache_size: "1.6" tracing_enabled: true endpoint_type: EDGE state: present ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="2" name: Setup AWS API Gateway setup on AWS and deploy API definition2 awsapigateway: stage: production cache_enabled: true cache_size: "1.6" tracing_enabled: true endpoint_type: EDGE state: present ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="3" name: Setup AWS API Gateway setup on AWS and deploy API 222 awsapigateway: swagger_file: swaggerFileWithoutAuthorizer.yaml stage: production cache_enabled: true cache_size: "1.6" tracing_enabled: true endpoint_type: EDGE state: present ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="3" name: Setup AWS API Gateway setup on AWS and deploy API 222 awsapigateway: swagger_text: | openapi: 3.0.0 info: title: Sample API description: Optional multiline or single-line description version: 0.1.9 components: ssecuritySchemes: requestauthorizersingle_stagevar: type: apiKey name: Unused in: header x-amazon-apigateway-authtype: custom stage: production cache_enabled: true cache_size: "1.6" tracing_enabled: true endpoint_type: EDGE state: present ``` </details> ```yaml title="Negative test num. 1 - yaml file" name: Setup AWS API Gateway setup on AWS and deploy API definition3 community.aws.awsapigateway: swagger_file: swaggerFile.yaml stage: production cache_enabled: true cache_size: "1.6" tracing_enabled: true endpoint_type: EDGE state: present ``` ```yaml title="Negative test num. 2 - yaml file" name: Setup AWS API Gateway setup on AWS and deploy API definition22222 community.aws.awsapigateway: swagger_dict: { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "email": "user@gmail.com" }, }, "components": { "securitySchemes": { "requestauthorizersingle_stagevar": { "type": "apiKey", "name": "Unused", "in": "header", "x-amazon-apigateway-authtype": "custom", "x-amazon-apigateway-authorizer": { "type": "request", "identitySource": "stageVariables.stage", "authorizerCredentials": "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole", "authorizerUri": "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations", "authorizerResultTtlInSeconds": 300, }, }, }, }, } stage: production cache_enabled: true cache_size: "1.6" tracing_enabled: true endpoint_type: EDGE state: present ``` ```yaml title="Negative test num. 3 - yaml file" name: Setup AWS API Gateway setup on AWS and deploy API 222 awsapigateway: swagger_text: | openapi: 3.0.0 info: title: Sample API description: Optional multiline or single-line description version: 0.1.9 components: securitySchemes: requestauthorizersingle_stagevar: type: apiKey name: Unused in: header x-amazon-apigateway-authtype: custom x-amazon-apigateway-authorizer: type: request identitySource: stageVariables.stage authorizerCredentials: arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole authorizerUri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations authorizerResultTtlInSeconds: 300 stage: production cache_enabled: true cache_size: "1.6" tracing_enabled: true endpoint_type: EDGE state: present ```