Project: KICS (Provisioning / Security & Compliance)
File: 52790cad-d60d-41d5-8483-146f9f21208d.md

title: API Gateway Cache Cluster Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 52790cad-d60d-41d5-8483-146f9f21208d Query name: API Gateway Cache Cluster Disabled Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: AWS API Gateway should have cache clustering enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: "BatchJobDefinition" Resources: ProdPos1: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: !Ref MyDocumentationVersion ClientCertificateId: !Ref ClientCertificate TracingEnabled: true Variables: Stack: Prod MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ResourcePath: /stack HttpMethod: POST MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '999' ResourcePath: /stack HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '555' ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="31" AWSTemplateFormatVersion: "2010-09-09" Description: "BatchJobDefinition" Resources: ProdPos2: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: !Ref MyDocumentationVersion ClientCertificateId: !Ref ClientCertificate TracingEnabled: true Variables: Stack: Prod MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ResourcePath: /stack HttpMethod: POST MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '999' ResourcePath: /stack HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '555' CacheClusterEnabled: false ``` ```json title="Positive test num. 3 - json file" hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "ProdPos1": { "Type": "AWS::ApiGateway::Stage", "Properties": { "StageName": "Prod", "RestApiId": { "Ref": "MyRestApi" }, "DeploymentId": { "Ref": "TestDeployment" }, "DocumentationVersion": { "Ref": "MyDocumentationVersion" }, "ClientCertificateId": { "Ref": "ClientCertificate" }, "Variables": { "Stack": "Prod" }, "TracingEnabled": "true", "MethodSettings": [ { "ResourcePath": "/", "HttpMethod": "GET", "MetricsEnabled": "true", "DataTraceEnabled": "false" }, { "ResourcePath": "/stack", "HttpMethod": "POST", "MetricsEnabled": "true", "DataTraceEnabled": "false", "ThrottlingBurstLimit": "999" }, { "ResourcePath": "/stack", "HttpMethod": "GET", "MetricsEnabled": "true", "DataTraceEnabled": "false", "ThrottlingBurstLimit": "555" } ] } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "ProdPos2": { "Properties": { "CacheClusterEnabled": false, "ClientCertificateId": "ClientCertificate", "DeploymentId": "TestDeployment", "Description": "Prod Stage", "DocumentationVersion": "MyDocumentationVersion", "MethodSettings": [ { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/" }, { "DataTraceEnabled": "false", "HttpMethod": "POST", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "999" }, { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "555" } ], "RestApiId": "MyRestApi", "StageName": "Prod", "TracingEnabled": true, "Variables": { "Stack": "Prod" } }, "Type": "AWS::ApiGateway::Stage" } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "BatchJobDefinition" Resources: ProdNeg1: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: !Ref MyDocumentationVersion ClientCertificateId: !Ref ClientCertificate TracingEnabled: true Variables: Stack: Prod MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ResourcePath: /stack HttpMethod: POST MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '999' ResourcePath: /stack HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '555' CacheClusterEnabled: true ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "ProdNeg1": { "Properties": { "CacheClusterEnabled": true, "ClientCertificateId": "ClientCertificate", "DeploymentId": "TestDeployment", "Description": "Prod Stage", "DocumentationVersion": "MyDocumentationVersion", "MethodSettings": [ { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/" }, { "DataTraceEnabled": "false", "HttpMethod": "POST", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "999" }, { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "555" } ], "RestApiId": "MyRestApi", "StageName": "Prod", "TracingEnabled": true, "Variables": { "Stack": "Prod" } }, "Type": "AWS::ApiGateway::Stage" } } } ```