Control: 8 API Gateway routes should specify an authorization type

Description

This control checks if Amazon API Gateway routes have an authorization type. The control fails if the API Gateway route does not specify an authorization type.

API Gateway supports multiple mechanisms for controlling and managing access to your API. By specifying an authorization type, you can restrict access to your API to only authorized users or processes.

Remediation

To set an authorization type for HTTP APIs, see Controlling and managing access to an HTTP API in API Gateway in the API Gateway Developer Guide. To set an authorization type for WebSocket APIs, see Controlling and managing access to a WebSocket API in API Gateway in the API Gateway Developer Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_apigateway_8

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_apigateway_8 --share

SQL

This control uses a named query:

select
  'arn:' || partition || ':apigateway:' || region || '::/apis/' || api_id || '/routes/' || route_id as resource,
  case
    when authorization_type is null then 'alarm'
    else 'ok'
  end as status,
  case
    when authorization_type is null then route_id || ' authorization type not configured.'
    else route_id || ' authorization type ' || authorization_type || ' configured.'
  end as reason
  , region, account_id
from
  aws_api_gatewayv2_route;

Control: 8 API Gateway routes should specify an authorization type

Description

Remediation

Usage

SQL

Tags