API Gateway APIs Should Use SSL Certificates

More Info:

Your Amazon API Gateway APIs should be using SSL certificates to verify that HTTP requests made to your backend system are from API Gateway service.

Risk Level

Medium

Address

Security

Compliance Standards

NIST

Triage and Remediation

Cause
Remediation

Check Cause

Using Console

Sign in to the AWS Management Console.
Navigate to the API Gateway service by typing ‘API Gateway’ in the search bar and selecting it from the dropdown menu.
In the API Gateway dashboard, you will see a list of all your APIs. Select the API you want to check.
Once you’ve selected the API, navigate to the ‘Custom Domain Names’ section in the left-hand menu. Here, you can see if an SSL certificate is associated with your API. If there is no SSL certificate, or if it’s expired, then it’s a misconfiguration.

Using CLI

First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the API Gateway services.
Once the AWS CLI is set up, you can list all the APIs in the API Gateway by using the following command:
```
aws apigateway get-rest-apis
```
This command will return a list of all the APIs in the API Gateway.
To check if an API is using SSL certificates, you need to get the details of each API. You can do this by using the following command:
```
aws apigateway get-rest-api --rest-api-id {rest-api-id}
```
Replace {rest-api-id} with the ID of the API you want to check. This command will return the details of the specified API.
In the returned details, look for the endpointConfiguration field. If the types field under endpointConfiguration is set to EDGE, it means the API is using a CloudFront distribution and SSL certificates are managed by AWS. If the types field is set to REGIONAL or PRIVATE, you need to manually manage SSL certificates.

Using Python

Install the necessary Python libraries: Before you start, make sure you have the necessary Python libraries installed. You will need the boto3 library, which is the Amazon Web Services (AWS) SDK for Python. It allows Python developers to write software that makes use of services like Amazon S3, Amazon EC2, etc. You can install it using pip:
```
pip install boto3
```
Configure AWS Credentials: You need to configure your AWS credentials. You can do this in several ways, but the simplest is to use the AWS CLI. Run aws configure and then enter your access key, secret access key, and default region when prompted.

Python Script: Now you can use the following Python script to check if API Gateway APIs are using SSL certificates:

import boto3

def check_api_gateway_ssl():
    client = boto3.client('apigateway')
    response = client.get_rest_apis()
    for api in response['items']:
        api_id = api['id']
        api_name = api['name']
        response = client.get_stages(restApiId=api_id)
        for stage in response['item']:
            if 'clientCertificateId' not in stage:
                print(f"API Gateway '{api_name}' does not use SSL certificate.")
            else:
                print(f"API Gateway '{api_name}' uses SSL certificate.")

check_api_gateway_ssl()

This script retrieves all the API Gateways and checks if they have a client certificate ID associated with them. If they don’t, it means they are not using SSL certificates.

Run the Script: Finally, you can run the script using a Python interpreter. If any API Gateway is not using SSL certificates, it will be printed out. Please note that this script only checks for the existence of a client certificate ID, not whether the certificate is valid or expired. You may need to add additional checks depending on your requirements.

Remediation

Using Console

To remediate the misconfiguration “API Gateway APIs should use SSL Certificates” in AWS using the AWS console, follow the below steps:

Login to the AWS Management Console and navigate to the Amazon API Gateway service.
Select the API that needs to be remediated.
In the left-hand panel, select the “Stages” option.
Select the stage that needs to be remediated.
In the “Settings” tab, scroll down to the “Security” section.
In the “Security” section, select the “Edit” button.
In the “Edit Security” dialog box, select the “Enable HTTPS” checkbox.
Choose the SSL certificate from the dropdown list or upload a new one.
Click “Save Changes” to remediate the misconfiguration.
Repeat the above steps for all the APIs that are not using SSL certificates.

By following the above steps, you can remediate the “API Gateway APIs should use SSL Certificates” misconfiguration in AWS using the AWS console.

Using CLI

To remediate the misconfiguration “API Gateway APIs Should Use SSL Certificates” for AWS using AWS CLI, follow these steps:

Open the AWS CLI and run the following command to list all the APIs in the API Gateway:
```
aws apigateway get-rest-apis
```
This will return a list of all the APIs in the API Gateway.
Identify the API that does not have an SSL certificate attached to it.
Run the following command to create an SSL certificate:
```
aws acm request-certificate --domain-name <your_domain_name> --validation-method DNS
```
Replace <your_domain_name> with the domain name that you want to use for the SSL certificate. This will create a new SSL certificate.
Run the following command to get the ARN of the SSL certificate:
```
aws acm list-certificates
```
This will return a list of all the SSL certificates that have been created.
Identify the ARN of the SSL certificate that you just created.
Run the following command to update the API Gateway to use the SSL certificate:
```
aws apigateway update-rest-api --rest-api-id <your_rest_api_id> --patch-operations op=replace,path=/protocolType,value=HTTPS op=add,path=/tlsConfig/serverName,value=<your_domain_name> op=add,path=/tlsConfig/serverCertificateId,value=<your_ssl_certificate_arn>
```
Replace <your_rest_api_id> with the ID of the API that you want to update. Replace <your_domain_name> with the domain name that you used for the SSL certificate. Replace <your_ssl_certificate_arn> with the ARN of the SSL certificate that you just created.
Verify that the API is now using the SSL certificate by accessing the API using HTTPS.

By following these steps, you can remediate the “API Gateway APIs Should Use SSL Certificates” misconfiguration for AWS using AWS CLI.

Using Python

To remediate the issue of API Gateway APIs not using SSL certificates in AWS, you can use the following steps using Python:

Import the necessary AWS SDK libraries for Python, including boto3 and botocore.

import boto3
from botocore.exceptions import ClientError

Create a new boto3 client for the API Gateway service.

api_gateway_client = boto3.client('apigateway')

Get a list of all APIs in the API Gateway service using the get_rest_apis() method.

api_list = api_gateway_client.get_rest_apis()

Loop through each API in the list and check if it has an SSL certificate attached to it using the get_domain_name() method.

for api in api_list['items']:
    api_id = api['id']
    try:
        domain_name = api_gateway_client.get_domain_name(restApiId=api_id)
        if domain_name['securityPolicy'] == 'TLS_1_0':
            # SSL certificate not attached, remediate the issue
            # ...
    except ClientError as e:
        # Handle any errors that occur during the API check
        print(e)

If the API does not have an SSL certificate attached, you can remediate the issue by creating a new SSL certificate using the AWS Certificate Manager service and attaching it to the API using the create_domain_name() and update_domain_name() methods.

# Create a new SSL certificate using AWS Certificate Manager
acm_client = boto3.client('acm')
certificate_arn = acm_client.request_certificate(
    DomainName='example.com',
    ValidationMethod='DNS'
)['CertificateArn']

# Attach the SSL certificate to the API using API Gateway
api_gateway_client.create_domain_name(
    domainName='example.com',
    certificateArn=certificate_arn,
    securityPolicy='TLS_1_2'
)

# Update the API Gateway API to use the new SSL certificate
api_gateway_client.update_domain_name(
    domainName='example.com',
    patchOperations=[
        {
            'op': 'replace',
            'path': '/certificateArn',
            'value': certificate_arn
        }
    ]
)

Repeat steps 4 and 5 for each API that does not have an SSL certificate attached.

Note: Make sure to replace the DomainName parameter in step 5 with the actual domain name of your API.

Additional Reading:

https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html

Documentation Index

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Remediation

​

​Additional Reading: