Project: KICS (Provisioning / Security & Compliance)
File: 7fd0d461-5b8c-4815-898c-f2b4b117eb28.md

title: API Gateway Without Configured Authorizer hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 7fd0d461-5b8c-4815-898c-f2b4b117eb28 Query name: API Gateway Without Configured Authorizer Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: API Gateway REST API should have an API Gateway Authorizer<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3" AWSTemplateFormatVersion: 2010-09-09 Resources: DevWebSocket: Type: 'AWS::ApiGatewayV2::Api' Properties: Name: TL-Dev-WebSocket-API ProtocolType: WEBSOCKET RouteSelectionExpression: $request.body.action ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="3" AWSTemplateFormatVersion: 2010-09-09 Resources: DevWebSocket5: Type: 'AWS::ApiGatewayV2::Api' Properties: Name: TL-Dev-WebSocket-API ProtocolType: WEBSOCKET RouteSelectionExpression: $request.body.action DevAuthorizerLambda5: Type: 'AWS::Serverless::Function' Properties: CodeUri: WebSockets/Authorizer Role: 'arn:aws:iam:::role/LambdaDynamoDB' Environment: Variables: STAGE: Dev DevAuthorizerLambdaPermission5: Type: 'AWS::Lambda::Permission' Properties: Action: 'lambda:invokeFunction' Principal: apigateway.amazonaws.com FunctionName: Ref: DevAuthorizerLambda SourceArn: 'Fn::Sub': >- arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiId}/${Stage}/$connect Stage: '*' ApiId: Ref: DevWebSocket DevWebSocketAuthorizer5: Type: 'AWS::ApiGatewayV2::Authorizer' Properties: Name: DevAuthorizer ApiId: Ref: DevWebSocket222222 AuthorizerType: REQUEST AuthorizerUri: 'Fn::Sub': >- arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DevAuthorizerLambda.Arn}/invocations IdentitySource: route.request.querystring.token ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="3" AWSTemplateFormatVersion: 2010-09-09 Resources: MyRestApi6: Type: AWS::ApiGateway::RestApi Properties: EndpointConfiguration: Types: PRIVATE Name: myRestApi ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="3" AWSTemplateFormatVersion: 2010-09-09 Resources: MyRestApi7: Type: AWS::ApiGateway::RestApi Properties: EndpointConfiguration: Types: PRIVATE Name: myRestApi Authorizer: Type: 'AWS::ApiGateway::Authorizer' Properties: RestApiId: !Ref MyRestApi242 ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="4" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "DevWebSocket8": { "Type": "AWS::ApiGatewayV2::Api", "Properties": { "Name": "TL-Dev-WebSocket-API", "ProtocolType": "WEBSOCKET", "RouteSelectionExpression": "$request.body.action" } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="20" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "DevWebSocketAuthorizer9": { "Type": "AWS::ApiGatewayV2::Authorizer", "Properties": { "ApiId": { "Ref": "DevWebSocket2err" }, "AuthorizerType": "REQUEST", "AuthorizerUri": { "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DevAuthorizerLambda.Arn}/invocations" }, "IdentitySource": [ "route.request.querystring.token" ], "Name": "DevAuthorizer" } }, "DevWebSocket9": { "Type": "AWS::ApiGatewayV2::Api", "Properties": { "Name": "TL-Dev-WebSocket-API", "ProtocolType": "WEBSOCKET", "RouteSelectionExpression": "$request.body.action" } }, "DevAuthorizerLambda9": { "Type": "AWS::Serverless::Function", "Properties": { "Environment": { "Variables": { "STAGE": "Dev" } }, "CodeUri": "WebSockets/Authorizer", "Role": "arn:aws:iam:::role/LambdaDynamoDB" } }, "DevAuthorizerLambdaPermission9": { "Type": "AWS::Lambda::Permission", "Properties": { "Principal":

"FunctionName": { "Ref": "DevAuthorizerLambda" }, "SourceArn": { "Fn::Sub": [ "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiId}/${Stage}/$connect", { "Stage": "*", "ApiId": { "Ref": "DevWebSocket" } } ] }, "Action": "lambda:invokeFunction" } } } } ``` </details> <details><summary>Positive test num. 7 - json file</summary> ```json hl_lines="4" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MyRestApi10": { "Type": "AWS::ApiGateway::RestApi", "Properties": { "EndpointConfiguration": { "Types": [ "PRIVATE" ] }, "Name": "myRestApi" } } } } ``` </details> <details><summary>Positive test num. 8 - json file</summary> ```json hl_lines="4" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MyRestApi11": { "Type": "AWS::ApiGateway::RestApi", "Properties": { "EndpointConfiguration": { "Types": [ "PRIVATE" ] }, "Name": "myRestApi" } }, "Authorizer": { "Type": "AWS::ApiGateway::Authorizer", "Properties": { "RestApiId": "MyRestApiwww2" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: DevWebSocket2: Type: 'AWS::ApiGatewayV2::Api' Properties: Name: TL-Dev-WebSocket-API ProtocolType: WEBSOCKET RouteSelectionExpression: $request.body.action DevAuthorizerLambda: Type: 'AWS::Serverless::Function' Properties: CodeUri: WebSockets/Authorizer Role: 'arn:aws:iam:::role/LambdaDynamoDB' Environment: Variables: STAGE: Dev DevAuthorizerLambdaPermission: Type: 'AWS::Lambda::Permission' Properties: Action: 'lambda:invokeFunction' Principal: apigateway.amazonaws.com FunctionName: Ref: DevAuthorizerLambda SourceArn: 'Fn::Sub': >- arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiId}/${Stage}/$connect Stage: '*' ApiId: Ref: DevWebSocket DevWebSocketAuthorizer: Type: 'AWS::ApiGatewayV2::Authorizer' Properties: Name: DevAuthorizer ApiId: Ref: DevWebSocket2 AuthorizerType: REQUEST AuthorizerUri: 'Fn::Sub': >- arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DevAuthorizerLambda.Arn}/invocations IdentitySource: route.request.querystring.token ``` ```yaml title="Negative test num. 2 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: MyRestApi2: Type: AWS::ApiGateway::RestApi Properties: EndpointConfiguration: Types: PRIVATE Name: myRestApi Authorizer: Type: 'AWS::ApiGateway::Authorizer' Properties: RestApiId: !Ref MyRestApi2 ``` ```json title="Negative test num. 3 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "DevWebSocket2": { "Type": "AWS::ApiGatewayV2::Api", "Properties": { "ProtocolType": "WEBSOCKET", "RouteSelectionExpression": "$request.body.action", "Name": "TL-Dev-WebSocket-API" } }, "DevAuthorizerLambda": { "Type": "AWS::Serverless::Function", "Properties": { "Environment": { "Variables": { "STAGE": "Dev" } }, "CodeUri": "WebSockets/Authorizer", "Role": "arn:aws:iam:::role/LambdaDynamoDB" } }, "DevAuthorizerLambdaPermission": { "Type": "AWS::Lambda::Permission", "Properties": { "Action": "lambda:invokeFunction", "Principal": "apigateway.amazonaws.com", "FunctionName": { "Ref": "DevAuthorizerLambda" }, "SourceArn": { "Fn::Sub": [ "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiId}/${Stage}/$connect", { "Stage": "*", "ApiId": { "Ref": "DevWebSocket" } } ] } } }, "DevWebSocketAuthorizer": { "Type": "AWS::ApiGatewayV2::Authorizer", "Properties": { "Name": "DevAuthorizer", "ApiId": { "Ref": "DevWebSocket2" }, "AuthorizerType": "REQUEST", "AuthorizerUri": { "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${DevAuthorizerLambda.Arn}/invocations" }, "IdentitySource": [ "route.request.querystring.token" ] } } } } ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MyRestApi3": { "Properties": { "EndpointConfiguration": { "Types": [ "PRIVATE" ] }, "Name": "myRestApi" }, "Type": "AWS::ApiGateway::RestApi" }, "Authorizer": { "Type": "AWS::ApiGateway::Authorizer", "Properties": { "RestApiId": "MyRestApi3" } } } } ``` </details>