Content Encoding Should Be Enabled For APIs

More Info:

Content Encoding feature should be enabled for your Amazon API Gateway APIs in order to facilitate API payload compression.

Risk Level

Low

Address

Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• StateRAMP
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Cause

Check Cause

Using Console

1. Log in to the AWS Management Console and navigate to the API Gateway service.

2. In the API Gateway dashboard, select the API you want to inspect.

3. In the left navigation pane, under the selected API, click on "Resources". This will display a list of all the resources and methods associated with the selected API.

4. Click on a method (like GET or POST) under a resource. In the Method Execution pane, click on "Method Response". If the HTTP status row (like 200) does not have "Content-Encoding: gzip" in the "Response Headers for 200" section, then content encoding is not enabled for the API.

Using CLI

1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the API Gateway.

2. Once the AWS CLI is installed and configured, you can list all the APIs in the API Gateway by using the following command:

   aws apigateway get-rest-apis

   This command will return a list of all the APIs in the API Gateway.

3. To check the content encoding for a specific API, you need to get the API's ID from the list obtained in the previous step. Then, use the following command to get the details of the specific API:

   aws apigateway get-rest-api --rest-api-id {api-id}

   Replace {api-id} with the ID of the API you want to check. This command will return the details of the specific API.

4. In the returned details, look for the contentEncodingEnabled field. If the value of this field is false, then content encoding is not enabled for the API. If the field is not present, it also means that content encoding is not enabled.

Using Python

1. Install the necessary Python libraries: Before you start, make sure you have the necessary Python libraries installed. You will need the boto3 library, which is the Amazon Web Services (AWS) SDK for Python. It allows Python developers to write software that makes use of services like Amazon S3, Amazon EC2, etc. You can install it using pip:

   pip install boto3

2. Configure AWS Credentials: Boto3 needs your AWS credentials (access key and secret access key) to call the AWS services. You can configure it in several ways. One way is to use the AWS CLI:

   aws configure

   It will prompt you for your Access Key Id, Secret Access Key, Default Region Name, and Default Output Format. You can find these details from your AWS console.

3. Write a Python script to check if Content Encoding is enabled for APIs in API Gateway:

   import boto3
   
   def check_content_encoding():
       client = boto3.client('apigateway')
       response = client.get_rest_apis()
       for api in response['items']:
           api_id = api['id']
           resources = client.get_resources(restApiId=api_id)
           for resource in resources['items']:
               if 'resourceMethods' in resource:
                   for method in resource['resourceMethods']:
                       method_response = client.get_method(restApiId=api_id, resourceId=resource['id'], httpMethod=method)
                       if 'methodIntegration' in method_response:
                           if 'contentHandling' not in method_response['methodIntegration'] or method_response['methodIntegration']['contentHandling'] != 'CONVERT_TO_BINARY':
                               print(f"API {api['name']} with method {method} does not have content encoding enabled")
   
   check_content_encoding()

   This script will list all the APIs in your AWS account and check if content encoding is enabled for each method in each API. If content encoding is not enabled, it will print the API name and the method.

4. Run the Python script: You can run the Python script using any Python environment. Make sure you have the necessary permissions to call the AWS services. If content encoding is not enabled for any API, it will print the API name and the method.

Remediation

Remediation

Using Console

To remediate the "Content Encoding Should Be Enabled For APIs" misconfiguration in AWS using the AWS console, follow these steps:

1. Open the AWS Management Console and navigate to the Amazon API Gateway service.

2. Select the API that you want to remediate.

3. In the left navigation pane, click on "Stages".

4. Select the appropriate stage for your API.

5. Click on the "Settings" tab.

6. Under the "Content Encoding" section, click on the "Edit" button.

7. Enable the "Content Encoding" option by selecting the checkbox.

8. Click on the "Save Changes" button.

9. Repeat steps 4-8 for all the stages of your API.

Enabling content encoding for your API will ensure that the API responses are compressed, which reduces the amount of data sent over the network and improves the performance of your API.

Using CLI

To remediate the "Content Encoding Should Be Enabled For APIs" misconfiguration in AWS using AWS CLI, follow the below steps:

1. Open the AWS CLI and run the following command to get the list of REST APIs in your account:

aws apigateway get-rest-apis

2. Choose the REST API for which you want to enable content encoding and make a note of its ID.

3. Run the following command to enable content encoding for the chosen REST API:

aws apigateway update-rest-api --rest-api-id <REST_API_ID> --patch-operations op=replace,path=/binaryMediaTypes,application/json+gzip

Replace <REST_API_ID> with the ID of the chosen REST API.

4. Verify that content encoding has been enabled for the REST API by running the following command:

aws apigateway get-rest-api --rest-api-id <REST_API_ID> --query binaryMediaTypes

Replace <REST_API_ID> with the ID of the chosen REST API. The output should include "application/json+gzip".

By following these steps, you can remediate the "Content Encoding Should Be Enabled For APIs" misconfiguration in AWS using AWS CLI.

Using Python

To remediate the "Content Encoding Should Be Enabled For APIs" misconfiguration for AWS using Python, you can follow the below steps:

1. Install the boto3 library using the following command:

   pip install boto3

2. Create an AWS session using the boto3 library:

   import boto3
   
   session = boto3.Session(
       aws_access_key_id='YOUR_ACCESS_KEY',
       aws_secret_access_key='YOUR_SECRET_KEY',
       region_name='YOUR_REGION'
   )

   Replace YOUR_ACCESS_KEY, YOUR_SECRET_KEY, and YOUR_REGION with your AWS access key ID, secret access key, and region respectively.

3. Create an API Gateway client using the boto3 library:

   client = session.client('apigateway')

4. Get the list of APIs using the get_rest_apis method:

   response = client.get_rest_apis()

5. Loop through the APIs and enable content encoding for each API using the update_rest_api method:

   for api in response['items']:
       api_id = api['id']
       patch_operations = [
           {
               'op': 'add',
               'path': '/binaryMediaTypes/*~1*',
               'value': 'application/json'
           }
       ]
       client.update_rest_api(restApiId=api_id, patchOperations=patch_operations)

   This code adds the application/json media type to the list of binary media types for each API, enabling content encoding.

6. Verify that content encoding is enabled for each API by checking the binaryMediaTypes property using the get_rest_api method:

   for api in response['items']:
       api_id = api['id']
       response = client.get_rest_api(restApiId=api_id)
       print(response['binaryMediaTypes'])

   This code prints the list of binary media types for each API, which should now include application/json.

By following these steps, you can remediate the "Content Encoding Should Be Enabled For APIs" misconfiguration for AWS using Python.

Using Terraform

resource "aws_api_gateway_rest_api" "THIS_API" {
  name                     = "REPLACE_WITH_API_NAME"
  description              = "REPLACE_WITH_OPTIONAL_DESCRIPTION"
  minimum_compression_size = 0 # Enable content encoding (compression) for all payload sizes

  # ... any other required arguments (e.g., endpoint_configuration, policy, etc.) ...
}

Replace THIS_API with your resource name and REPLACE_WITH_API_NAME / description as appropriate.
Setting minimum_compression_size = 0 matches the CLI fix (/minimumCompressionSize to 0) and enables compression for all response payload sizes; you may choose another non‑negative integer up to 10485760 if desired.

This change is in‑place for existing APIs (no resource replacement).

Verification: terraform plan should show an update to aws_api_gateway_rest_api.THIS_API with minimum_compression_size changing from its previous value (often null/0/unset) to 0.

Additional Reading:

• https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-enable-compression.html