Project: KICS (Provisioning / Security & Compliance)
File: 8275fab0-68ec-4705-bbf4-86975edb170e.md

title: API Gateway Without Security Policy hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8275fab0-68ec-4705-bbf4-86975edb170e Query name: API Gateway Without Security Policy Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: API Gateway should have a Security Policy defined and use TLS 1.2.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="20" AWSTemplateFormatVersion: "2010-09-09" Description: "Router53" Parameters: cfnDomainName: Type: String certificateArn: Type: String type: Type: String Resources: myDomainName: Type: AWS::ApiGateway::DomainName Properties: CertificateArn: !Ref certificateArn DomainName: !Ref cfnDomainName EndpointConfiguration: Types: !Ref type RegionalCertificateArn: !Ref certificateArn SecurityPolicy: "TLS10" Outputs: DomainName: Value: !Ref myDomainName ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="13" AWSTemplateFormatVersion: "2010-09-09" Description: "Router53" Parameters: cfnDomainName: Type: String certificateArn: Type: String type: Type: String Resources: myDomainName1: Type: AWS::ApiGateway::DomainName Properties: CertificateArn: !Ref certificateArn DomainName: !Ref cfnDomainName EndpointConfiguration: Types: !Ref type RegionalCertificateArn: !Ref certificateArn Outputs: DomainName: Value: !Ref myDomainName ``` ```json title="Positive test num. 3 - json file" hl_lines="26" { "Description": "Router53", "Parameters": { "cfnDomainName": { "Type": "String" }, "certificateArn": { "Type": "String" }, "type": { "Type": "String" } }, "Resources": { "myDomainName": { "Type": "AWS::ApiGateway::DomainName", "Properties": { "CertificateArn": "certificateArn", "DomainName": "cfnDomainName", "EndpointConfiguration": { "Types": [ "type" ] }, "RegionalCertificateArn": "certificateArn", "SecurityPolicy": "TLS10" } } }, "Outputs": { "DomainName": { "Value": "myDomainName" } }, "AWSTemplateFormatVersion": "2010-09-09" } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="15" { "Parameters": { "type": { "Type": "String" }, "cfnDomainName": { "Type": "String" }, "certificateArn": { "Type": "String" } }, "Resources": { "myDomainName1": { "Properties": { "DomainName": "cfnDomainName", "EndpointConfiguration": { "Types": [ "type" ] }, "RegionalCertificateArn": "certificateArn", "CertificateArn": "certificateArn" }, "Type": "AWS::ApiGateway::DomainName" } }, "Outputs": { "DomainName": { "Value": "myDomainName" } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Router53" } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "Router53" Parameters: cfnDomainName: Type: String certificateArn: Type: String type: Type: String Resources: myDomainName: Type: AWS::ApiGateway::DomainName Properties: CertificateArn: !Ref certificateArn DomainName: !Ref cfnDomainName EndpointConfiguration: Types: !Ref type RegionalCertificateArn: !Ref certificateArn SecurityPolicy: "TLS12" Outputs: DomainName: Value: !Ref myDomainName ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Router53", "Parameters": { "cfnDomainName": { "Type": "String" }, "certificateArn": { "Type": "String" }, "type": { "Type": "String" } }, "Resources": { "myDomainName": { "Type": "AWS::ApiGateway::DomainName", "Properties": { "DomainName": "cfnDomainName", "EndpointConfiguration": { "Types": [ "type" ] }, "RegionalCertificateArn": "certificateArn", "SecurityPolicy": "TLS12", "CertificateArn": "certificateArn" } } }, "Outputs": { "DomainName": { "Value": "myDomainName" } } } ```