Project: KICS (Provisioning / Security & Compliance)
File: ed4c48b8-eccc-4881-95c1-09fdae23db25.md

title: API Gateway Without SSL Certificate hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ed4c48b8-eccc-4881-95c1-09fdae23db25 Query name: API Gateway Without SSL Certificate Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: SSL Client Certificate should be enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" AWSTemplateFormatVersion: "2010-09-09" Resources: ProdApiGatewayStagePos: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: !Ref MyDocumentationVersion Variables: Stack: Prod MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ResourcePath: /stack HttpMethod: POST MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '999' ResourcePath: /stack HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '555' ``` ```json title="Positive test num. 2 - json file" hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "ProdApiGatewayStagePos2": { "Type": "AWS::ApiGateway::Stage", "Properties": { "MethodSettings": [ { "DataTraceEnabled": "false", "ResourcePath": "/", "HttpMethod": "GET", "MetricsEnabled": "true" }, { "ResourcePath": "/stack", "HttpMethod": "POST", "MetricsEnabled": "true", "DataTraceEnabled": "false", "ThrottlingBurstLimit": "999" }, { "MetricsEnabled": "true", "DataTraceEnabled": "false", "ThrottlingBurstLimit": "555", "ResourcePath": "/stack", "HttpMethod": "GET" } ], "StageName": "Prod", "RestApiId": "MyRestApi", "DeploymentId": "TestDeployment", "DocumentationVersion": "MyDocumentationVersion", "Variables": { "Stack": "Prod" } } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Resources: ProdApiGatewayStageNeg: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: !Ref MyDocumentationVersion ClientCertificateId: !Ref ClientCertificate Variables: Stack: Prod MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ResourcePath: /stack HttpMethod: POST MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '999' ResourcePath: /stack HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '555' ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "ProdApiGatewayStageNeg2": { "Type": "AWS::ApiGateway::Stage", "Properties": { "StageName": "Prod", "RestApiId": { "Ref": "MyRestApi" }, "DeploymentId": { "Ref": "TestDeployment" }, "DocumentationVersion": { "Ref": "MyDocumentationVersion" }, "ClientCertificateId": { "Ref": "ClientCertificate" }, "Variables": { "Stack": "Prod" }, "MethodSettings": [ { "ResourcePath": "/", "HttpMethod": "GET", "MetricsEnabled": "true", "DataTraceEnabled": "false" }, { "ResourcePath": "/stack", "HttpMethod": "POST", "MetricsEnabled": "true", "DataTraceEnabled": "false", "ThrottlingBurstLimit": "999" }, { "ResourcePath": "/stack", "HttpMethod": "GET", "MetricsEnabled": "true", "DataTraceEnabled": "false", "ThrottlingBurstLimit": "555" } ] } } } } ```