Project: KICS (Provisioning / Security & Compliance)
File: a186e82c-1078-4a7b-85d8-579561fde884.md

title: API Gateway without WAF hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: a186e82c-1078-4a7b-85d8-579561fde884 Query name: API Gateway without WAF Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: API Gateway should have WAF (Web Application Firewall) enabled<br> ```tf title="Positive test num. 1 - tf file" hl_lines="75" resource "awswafregionalipset" "ipset" { name = "tfIPSet" ipsetdescriptor { type = "IPV4" value = "192.0.7.0/24" } } resource "awswafregionalrule" "foo" { name = "tfWAFRule" metric_name = "tfWAFRule" predicate { dataid = awswafregional_ipset.ipset.id negated = false type = "IPMatch" } } resource "awswafregionalweb_acl" "foo" { name = "foo" metric_name = "foo" default_action { type = "ALLOW" } rule { action { type = "BLOCK" } priority = 1 ruleid = awswafregional_rule.foo.id } } resource "awsapigatewayrestapi" "example" { body = jsonencode({ openapi = "3.0.1" info = { title = "example" version = "1.0" } paths = { "/path1" = { get = { x-amazon-apigateway-integration = { httpMethod = "GET" payloadFormatVersion = "1.0" type = "HTTP_PROXY" uri = "https://ip-ranges.amazonaws.com/ip-ranges.json" } } } } }) name = "example" } resource "awsapigateway_deployment" "example" { restapiid = awsapigatewayrestapi.example.id triggers = { redeployment = sha1(jsonencode(awsapigatewayrestapi.example.body)) } lifecycle { createbeforedestroy = true } } resource "awsapigateway_stage" "positive1" { deploymentid = awsapigatewaydeployment.example.id restapiid = awsapigatewayrestapi.example.id stage_name = "example" } resource "awswafregionalwebaclassociation" "association" { resourcearn = awsapigatewaystage.positive.arn webaclid = awswafregionalweb_acl.foo.id } ``` ```tf title="Negative test num. 1 - tf file" resource "awswafregionalipset" "ipset" { name = "tfIPSet" ipsetdescriptor { type = "IPV4" value = "192.0.7.0/24" } } resource "awswafregionalrule" "foo" { name = "tfWAFRule" metric_name = "tfWAFRule" predicate { dataid = awswafregional_ipset.ipset.id negated = false type = "IPMatch" } } resource "awswafregionalweb_acl" "foo" { name = "foo" metric_name = "foo" default_action { type = "ALLOW" } rule { action { type = "BLOCK" } priority = 1 ruleid = awswafregional_rule.foo.id } } resource "awsapigatewayrestapi" "example" { body = jsonencode({ openapi = "3.0.1" info = { title = "example" version = "1.0" } paths = { "/path1" = { get = { x-amazon-apigateway-integration = { httpMethod = "GET" payloadFormatVersion = "1.0" type = "HTTP_PROXY" uri = "https://ip-ranges.amazonaws.com/ip-ranges.json" } } } } }) name = "example" } resource "awsapigateway_deployment" "example" { restapiid = awsapigatewayrestapi.example.id triggers = { redeployment = sha1(jsonencode(awsapigatewayrestapi.example.body)) } lifecycle { createbeforedestroy = true } } resource "awsapigateway_stage" "negative1" { deploymentid = awsapigatewaydeployment.example.id restapiid = awsapigatewayrestapi.example.id stage_name = "example" } resource "awswafregionalwebaclassociation" "association" { resourcearn = awsapigatewaystage.negative1.arn webaclid = awswafregionalweb_acl.foo.id } ``` ```tf title="Negative test num. 2 - tf file" resource "awsapigatewayrestapi" "example" { body = jsonencode({ openapi = "3.0.1" info = { title = "example" version = "1.0" } paths = { "/path1" = { get = { x-amazon-apigateway-integration = { httpMethod = "GET" payloadFormatVersion = "1.0" type = "HTTP_PROXY" uri = "https://ip-ranges.amazonaws.com/ip-ranges.json" } } } } }) name = "example" } resource "awsapigateway_deployment" "example" { restapiid = awsapigatewayrestapi.example.id triggers = { redeployment = sha1(jsonencode(awsapigatewayrestapi.example.body)) } lifecycle { createbeforedestroy = true } } resource "awsapigateway_stage" "negative2" { deploymentid = awsapigatewaydeployment.example.id restapiid = awsapigatewayrestapi.example.id stage_name = "example" } resource "awswafv2web_acl" "foo" { name = "foo" scope = "REGIONAL" default_action { allow {} } visibility_config { cloudwatchmetricsenabled = false metric_name = "foo" sampledrequestsenabled = false } } resource "awswafv2webaclassociation" "association" { resourcearn = awsapigatewaystage.negative2.arn webaclarn = awswafv2web_acl.foo.arn } ```