API Gateway V2 Should Have Authorization Type Configuration

More Info:

This rule verifies whether Amazon API Gatewayv2 API routes have an authorization type configured. It ensures that appropriate authentication and authorization mechanisms are in place for accessing the API routes. The rule is marked as non-compliant if the authorization type is set to NONE, indicating that no authentication is required to access the routes

Risk Level

Medium

Address

Security

Compliance Standards

CBP,SEBI

Triage and Remediation

Cause
Remediation

Check Cause

Using Console

Log in to the AWS Management Console and navigate to the API Gateway service.
In the API Gateway dashboard, select the API Gateway V2 that you want to check.
In the API Gateway V2 details page, select the ‘Routes’ option from the left-hand side menu.
For each route, check the ‘Authorization’ column. If the value is ‘NONE’ or not set, then the API Gateway V2 does not have an Authorization Type configuration.

Using CLI

Install and configure AWS CLI: Before you can start using AWS CLI, you need to install it on your local machine and configure it with your AWS account credentials. You can do this by running the following commands: Installation:
```
pip install awscli
```
Configuration:
```
aws configure
```
You will be prompted to provide your AWS Access Key ID, Secret Access Key, Default region name, and Default output format.
List all API Gateway V2 APIs: Use the following AWS CLI command to list all your API Gateway V2 APIs:
```
aws apigatewayv2 get-apis
```
This command will return a list of all your APIs, including their API ID, name, protocol type, and other details.
Get the details of each API: For each API in the list, use the following AWS CLI command to get its details:
```
aws apigatewayv2 get-api --api-id <API_ID>
```
Replace <API_ID> with the ID of the API you want to check. This command will return the details of the specified API, including its authorization type.
Check the authorization type: In the output of the previous command, look for the AuthorizationType field. If this field is not present or its value is NONE, it means that the API does not have an authorization type configured.

Using Python

Install the necessary Python libraries: Before you start, you need to install the AWS SDK for Python (Boto3) to interact with AWS services. You can install it using pip:
```
pip install boto3
```
Set up AWS credentials: You need to configure your AWS credentials. You can do this by creating the files ~/.aws/credentials and ~/.aws/config. In the credentials file, add:
```
[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
```
In the config file, add:
```
[default]
region=us-east-1
```

Write a Python script to check the authorization type configuration: You can use the following Python script to check the authorization type configuration in API Gateway V2:

import boto3

client = boto3.client('apigatewayv2')

response = client.get_apis()

for item in response['Items']:
    api_id = item['ApiId']
    api_name = item['Name']
    try:
        response = client.get_authorizers(
            ApiId=api_id
        )
        if 'Items' in response:
            for authorizer in response['Items']:
                print(f"API Name: {api_name}, Authorizer Name: {authorizer['Name']}, Authorization Type: {authorizer['AuthorizationType']}")
        else:
            print(f"API Name: {api_name} does not have an authorizer configured.")
    except Exception as e:
        print(f"Error getting authorizer for API: {api_name}. Error: {str(e)}")

Run the Python script: You can run the Python script using the command:
```
python check_authorization.py
```
This script will print the name of each API, the name of its authorizer (if any), and the authorization type. If an API does not have an authorizer configured, it will print a message indicating this.

Remediation

Using Console

To remediate the misconfiguration of API Gateway V2 not having an Authorization Type configured in AWS, you can follow these steps using the AWS Management Console:

Login to AWS Console: Go to the AWS Management Console at https://console.aws.amazon.com/.
Navigate to API Gateway: Click on the “Services” dropdown in the top left corner and select “API Gateway” under the Networking & Content Delivery section.
Select the API: In the API Gateway dashboard, select the API that you want to remediate from the list of APIs.
Configure Authorization Type:
- Click on the “Routes” tab on the left-hand side of the console.
- Select the route for which you want to configure the Authorization Type.
- Click on the “Authorization” tab in the route configuration.
- Under the “Authorization Type” dropdown, select the appropriate authorization type based on your requirements (e.g., JWT, AWS IAM, Lambda Authorizer, etc.).
Save Changes: After selecting the desired Authorization Type, click on the “Save” button to apply the changes.
Test the Configuration: It is recommended to test the API with the new Authorization Type to ensure that the configuration is working as expected.

By following these steps, you can remediate the misconfiguration of API Gateway V2 not having an Authorization Type configured in AWS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of API Gateway V2 not having an Authorization Type configuration in AWS, you can follow these steps using AWS CLI:

List all the APIs in your AWS account to identify the API Gateway V2 that needs to be remediated:

aws apigatewayv2 get-apis

Identify the API Gateway V2 that needs to be updated based on the API ID.
Update the API Gateway V2 with the required Authorization Type configuration. You can set the Authorization Type to one of the following values: NONE, AWS_IAM, CUSTOM, or JWT.

For example, to set the Authorization Type to AWS_IAM for the identified API Gateway V2, you can use the following command:

aws apigatewayv2 update-api --api-id <API_ID> --authorization-type AWS_IAM

Replace <API_ID> with the actual API ID of the API Gateway V2 that needs to be remediated.

Verify the changes by describing the API to ensure that the Authorization Type configuration has been updated successfully:

aws apigatewayv2 get-api --api-id <API_ID>

By following these steps and updating the API Gateway V2 with the appropriate Authorization Type configuration using AWS CLI, you can remediate the misconfiguration of API Gateway V2 not having an Authorization Type set in AWS.

Using Python

To remediate the misconfiguration of API Gateway V2 not having an authorization type configured in AWS, you can follow these steps using Python:

Import the necessary Python libraries for interacting with AWS services:

import boto3

Initialize the AWS API Gateway client:

client = boto3.client('apigatewayv2')

Get a list of existing APIs in API Gateway V2:

apis = client.get_apis()

Iterate through the list of APIs to find the one that needs the authorization type configuration:

for api in apis['Items']:
    api_id = api['ApiId']
    api_name = api['Name']
    
    # Check if the API needs authorization type configuration
    if not api.get('AuthorizationType'):
        # Add the required authorization type configuration
        response = client.update_api(
            ApiId=api_id,
            AuthorizationType='JWT',  # You can replace 'JWT' with the desired authorization type
            # Add other required authorization configurations here
        )
        print(f"Authorization type configured for API: {api_name}")

Run the Python script to apply the authorization type configuration to the API Gateway V2 APIs that do not have it configured.

By following these steps, you can remediate the misconfiguration of API Gateway V2 APIs not having an authorization type configured in AWS using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

API Gateway V2 Should Have Authorization Type Configuration

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Remediation

​

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Remediation