Project: KICS (Provisioning / Security & Compliance)
File: fcbf9019-566c-4832-a65c-af00d8137d2b.md

title: API Gateway without WAF hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fcbf9019-566c-4832-a65c-af00d8137d2b Query name: API Gateway without WAF Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: API Gateway should have WAF (Web Application Firewall) enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: "2010-09-09" Description: "BatchJobDefinition" Resources: Prod: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: !Ref MyDocumentationVersion ClientCertificateId: !Ref ClientCertificate Variables: Stack: Prod MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ResourcePath: /stack HttpMethod: POST MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '999' ResourcePath: /stack HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '555' SampleWebACLAssociation: Type: 'AWS::WAFv2::WebACLAssociation' Properties: WebACLArn: ExampleARNForWebACL ResourceArn: arn:aws:apigateway:region::/restapis/api-id/stages/stage ``` ```json title="Positive test num. 2 - json file" hl_lines="33" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "Prod": { "Properties": { "ClientCertificateId": "ClientCertificate", "DeploymentId": "TestDeployment", "Description": "Prod Stage", "DocumentationVersion": "MyDocumentationVersion", "MethodSettings": [ { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/" }, { "DataTraceEnabled": "false", "HttpMethod": "POST", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "999" }, { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "555" } ], "RestApiId": "MyRestApi", "StageName": "Prod", "Variables": { "Stack": "Prod" } }, "Type": "AWS::ApiGateway::Stage" }, "SampleWebACLAssociation": { "Properties": { "ResourceArn": "arn:aws:apigateway:region::/restapis/api-id/stages/stage", "WebACLArn": "ExampleARNForWebACL" }, "Type": "AWS::WAFv2::WebACLAssociation" } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "BatchJobDefinition" Resources: Production: Type: AWS::ApiGateway::Stage Properties: StageName: Production Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: !Ref MyDocumentationVersion ClientCertificateId: !Ref ClientCertificate Variables: Stack: Production MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ResourcePath: /stack HttpMethod: POST MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '999' ResourcePath: /stack HttpMethod: GET MetricsEnabled: 'true' DataTraceEnabled: 'false' ThrottlingBurstLimit: '555' SampleWebACLAssociation: Type: 'AWS::WAFv2::WebACLAssociation' Properties: WebACLArn: ExampleARNForWebACL ResourceArn: arn:aws:apigateway:region::/restapis/api-id/stages/Production ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "Production": { "Properties": { "ClientCertificateId": "ClientCertificate", "DeploymentId": "TestDeployment", "Description": "Prod Stage", "DocumentationVersion": "MyDocumentationVersion", "MethodSettings": [ { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/" }, { "DataTraceEnabled": "false", "HttpMethod": "POST", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "999" }, { "DataTraceEnabled": "false", "HttpMethod": "GET", "MetricsEnabled": "true", "ResourcePath": "/stack", "ThrottlingBurstLimit": "555" } ], "RestApiId": "MyRestApi", "StageName": "Production", "Variables": { "Stack": "Production" } }, "Type": "AWS::ApiGateway::Stage" }, "SampleWebACLAssociation": { "Properties": { "ResourceArn": "arn:aws:apigateway:region::/restapis/api-id/stages/Production", "WebACLArn": "ExampleARNForWebACL" }, "Type": "AWS::WAFv2::WebACLAssociation" } } } ```