Enable Encryption For API Cache

More Info:

Ensure that your Amazon API Gateway REST APIs are configured to encrypt API cached responses in order to protect data while in transit (as it travels to and from Amazon API Gateway).

Risk Level

High

Address

Security

Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

Triage and Remediation

Cause
Remediation

Check Cause

Using Console

Sign in to the AWS Management Console and open the Amazon API Gateway console at https://console.aws.amazon.com/apigateway/.
In the navigation pane, choose the API Gateway service.
In the APIs list, select the API you want to check.
In the API details page, select the “Stages” option from the left side menu.
In the Stages section, select the stage of the API you want to check.
In the Stage Editor panel, under the “Cache Settings” section, check the “Cache Encryption Enabled” field. If it’s set to “Yes”, then the encryption for API cache is enabled. If it’s set to “No”, then the encryption for API cache is not enabled.

Using CLI

First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the API Gateway.
Once the AWS CLI is installed and configured, you can use the following command to list all the APIs in your AWS account:
```
aws apigateway get-rest-apis
```
This command will return a list of all the APIs in your account. Note down the “id” of the API you want to check.
Now, you can use the following command to get the details of the specific API:
```
aws apigateway get-rest-api --rest-api-id {API_ID}
```
Replace with the id of the API you noted down in the previous step. This command will return the details of the API.
In the output of the above command, look for the “cacheClusterEnabled” and “cacheClusterSize” fields. If the “cacheClusterEnabled” field is set to true and the “cacheClusterSize” field is not null, it means that the API cache is enabled. If the “cacheClusterEncrypted” field is set to true, it means that the API cache is encrypted. If it’s set to false or not present, it means that the API cache is not encrypted.

Using Python

To check if encryption is enabled for API Cache in API Gateway using Python scripts, you can use the Boto3 library, which allows you to write software that makes use of services like Amazon S3, Amazon EC2, and others. Here are the steps:

Import the necessary libraries: You need to import Boto3, the AWS SDK for Python, to interact with AWS services.
```
import boto3
```

Create a session: You need to create a session using your AWS credentials.

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY',
    aws_secret_access_key='YOUR_SECRET_KEY',
    region_name='us-west-2'
)

Create an API Gateway client: Use the session to create a client for the API Gateway service.
```
client = session.client('apigateway')
```

List and check the APIs: Use the client to list all the APIs and check if encryption is enabled for API Cache.

response = client.get_rest_apis()

for item in response['items']:
    api_id = item['id']
    api_name = item['name']
    api_response = client.get_stages(
        restApiId=api_id
    )
    for stage in api_response['item']:
        if 'cacheClusterEnabled' in stage and stage['cacheClusterEnabled']:
            if 'cacheClusterSize' in stage and stage['cacheClusterSize']:
                print(f"API Gateway '{api_name}' has cache enabled with size {stage['cacheClusterSize']}")
            else:
                print(f"API Gateway '{api_name}' has cache enabled but size is not specified")
        else:
            print(f"API Gateway '{api_name}' does not have cache enabled")

This script will print out the status of cache encryption for each API in the API Gateway. If the cache is enabled, it will print out the size of the cache. If the cache is not enabled, it will print out a message stating that the cache is not enabled.

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration “Enable Encryption for API Cache” in AWS using the AWS console:

Open the Amazon API Gateway console at https://console.aws.amazon.com/apigateway/.
In the navigation pane, choose “Caches” under the API you want to configure.
Select the API cache for which you want to enable encryption.
Choose “Edit” to modify the cache settings.
In the “Cache Settings” section, select “Enable Encryption” under “Cache Data Encryption”.
Choose the KMS key that you want to use for encryption from the “KMS Key” drop-down list. If you don’t have a KMS key, you can create one by choosing “Create a new KMS key”.
Choose “Save” to save the changes.

That’s it! You have now enabled encryption for API cache in AWS using the AWS console.

Using CLI

To remediate the misconfiguration “Enable Encryption For API Cache” in AWS using AWS CLI, follow these steps:

Open the AWS CLI and run the following command to get a list of all the cache clusters in your AWS account:

aws elasticache describe-cache-clusters

Identify the cache cluster that needs to be encrypted and note down its name.
Run the following command to enable encryption for the cache cluster:

aws elasticache modify-cache-cluster --cache-cluster-id <cache-cluster-id> --engine-secuity-group-names <security-group-name> --transit-encryption Enabled

Replace <cache-cluster-id> with the name of the cache cluster identified in step 2 and <security-group-name> with the name of the security group associated with the cache cluster.

Verify that encryption has been enabled for the cache cluster by running the following command:

aws elasticache describe-cache-clusters --cache-cluster-id <cache-cluster-id>

Replace <cache-cluster-id> with the name of the cache cluster identified in step 2.

If the encryption has been successfully enabled, the output of the above command will contain the following line:

"TransitEncryptionEnabled": true

By following these steps, you can remediate the misconfiguration “Enable Encryption For API Cache” in AWS using AWS CLI.

Using Python

To remediate the misconfiguration “Enable Encryption For API Cache” in AWS using Python, follow these steps:

Open the AWS Management Console and navigate to the Amazon API Gateway service.
Select the API that you want to remediate and click on the “Stages” tab.
Click on the “Cache” tab and select the cache that you want to remediate.
Click on the “Settings” button and select “Enable Encryption”.
In the “Enable Encryption” dialog box, select the KMS key that you want to use for encryption.
Click on the “Enable” button to enable encryption for the API cache.
To automate this process using Python, you can use the AWS SDK for Python (Boto3) to write a script that performs the above steps. Here is an example script:

import boto3

# Set the AWS region
region = 'us-west-2'

# Set the API Gateway API ID and stage name
api_id = 'your_api_id'
stage_name = 'your_stage_name'

# Set the cache ID
cache_id = 'your_cache_id'

# Set the KMS key ID for encryption
kms_key_id = 'your_kms_key_id'

# Create an API Gateway client
client = boto3.client('apigateway', region_name=region)

# Enable encryption for the cache
client.update_stage(
    restApiId=api_id,
    stageName=stage_name,
    patchOperations=[
        {
            'op': 'replace',
            'path': '/caching/dataEncrypted',
            'value': 'true'
        },
        {
            'op': 'replace',
            'path': '/caching/encryptionEnabled',
            'value': 'true'
        },
        {
            'op': 'replace',
            'path': '/caching/kmsKeyId',
            'value': kms_key_id
        }
    ]
)

Note: Replace the placeholders “your_api_id”, “your_stage_name”, “your_cache_id”, and “your_kms_key_id” with your own values. Also, make sure that you have the necessary permissions to perform this operation.

Additional Reading:

https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html

Documentation Index

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Remediation

​

​Additional Reading: