The client-side SSL certificates used by your Amazon API Gateway REST APIs for secure authentication at the API integration endpoint level should be rotated before their expiration date
In the APIs pane, choose the API you want to check.
In the API details pane, choose ‘Client Certificates’.
In the Client Certificates pane, you can see the expiration date of the SSL client certificate. If the certificate is about to expire, it indicates a misconfiguration.
Using CLI
First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the API Gateway.
Once the AWS CLI is installed and configured, you can use the following command to list all the APIs in your AWS account:
aws apigateway get-rest-apis
This command will return a list of all the APIs in your account. Note down the id of the API you want to check.
Now, you can use the following command to get the details of the API:
Replace <your-api-id> with the id of your API. This command will return the details of the API including the client certificate id if one is associated with the API.
Finally, you can use the following command to get the details of the client certificate:
Replace <your-client-certificate-id> with the id of your client certificate. This command will return the details of the client certificate including the expiration date. You can then check if the certificate is about to expire.
Using Python
Setup AWS SDK (Boto3) in Python:
First, you need to set up AWS SDK (Boto3) in your Python environment. You can install it using pip:
pip install boto3
Then, configure your AWS credentials either by setting up environment variables or by using the AWS CLI.
List all the API Gateways:
Use the get_rest_apis function from the apigateway client in Boto3 to list all the API Gateways in your AWS account. Here is a sample script:
import boto3def list_apis(): client = boto3.client('apigateway') response = client.get_rest_apis() return response['items']apis = list_apis()for api in apis: print(api['name'], api['id'])
This script will print the name and ID of all the API Gateways.
Get the Client Certificate of each API Gateway:
Use the get_client_certificate function from the apigateway client in Boto3 to get the details of the client certificate of each API Gateway. Here is a sample script:
import boto3def get_certificate(api_id): client = boto3.client('apigateway') response = client.get_client_certificate(clientCertificateId=api_id) return responseapis = list_apis()for api in apis: certificate = get_certificate(api['id']) print(certificate)
This script will print the details of the client certificate of each API Gateway.
Check the Expiration Date of the Client Certificate:
The get_client_certificate function returns a dictionary that includes the expirationDate of the client certificate. You can compare this date with the current date to check if the certificate is expiring soon. Here is a sample script:
import boto3from datetime import datetime, timedeltadef is_expiring_soon(certificate): expiration_date = datetime.fromtimestamp(certificate['expirationDate']) return expiration_date < datetime.now() + timedelta(days=30)apis = list_apis()for api in apis: certificate = get_certificate(api['id']) if is_expiring_soon(certificate): print(f"The client certificate of the API Gateway {api['name']} is expiring soon.")
This script will print a warning message for each API Gateway whose client certificate is expiring in less than 30 days.
To remediate the misconfiguration of expiring SSL client certificates that should be rotated in AWS using AWS CLI, follow the below steps:
Open the AWS CLI on your local machine.
Run the following command to list all the IAM users with expiring SSL client certificates:
aws iam list-users --query "Users[].[UserName,UserId,SSHPublicKeys[?SSHPublicKeyId==null]|[?SSHPublicKeyId==''],SSHPublicKeys[?SSHPublicKeyId!=null].[SSHPublicKeyId,Status,UploadDate,UserName]]" --output table
This command will list all the IAM users with expiring SSL client certificates.
Identify the IAM user(s) that need to rotate their SSL client certificates.
Run the following command to delete the expiring SSL client certificate(s) for the identified IAM user(s):
aws iam delete-ssh-public-key --user-name <IAM user name> --ssh-public-key-id <SSH public key ID>
Make sure to replace <IAM user name> and <SSH public key ID> with the actual values.
Run the following command to upload a new SSL client certificate for the identified IAM user(s):
aws iam upload-ssh-public-key --user-name <IAM user name> --ssh-public-key-body <SSH public key>
Make sure to replace <IAM user name> and <SSH public key> with the actual values.
Verify that the new SSL client certificate has been uploaded successfully by running the following command:
aws iam list-ssh-public-keys --user-name <IAM user name> --query "SSHPublicKeys[].[SSHPublicKeyId,Status,UploadDate,UserName]" --output table
Make sure to replace <IAM user name> with the actual value.
Repeat steps 3 to 6 for all the IAM users with expiring SSL client certificates.
By following the above steps, you can remediate the misconfiguration of expiring SSL client certificates that should be rotated in AWS using AWS CLI.
Using Python
To remediate the issue of expiring SSL client certificates that should be rotated in AWS using Python, you can follow the below steps:
First, you need to identify the SSL client certificates that are going to expire soon. You can use the AWS SDK for Python (Boto3) to get the information about the SSL client certificates. The following code snippet can be used to retrieve the SSL client certificates:
import boto3from datetime import datetime, timedeltaclient = boto3.client('iam')# Get the list of SSL client certificatesssl_certs = client.list_server_certificates()['ServerCertificateMetadataList']# Get the current date and timenow = datetime.now()# Define the threshold for expirationexpiration_threshold = timedelta(days=30)# Loop through the SSL client certificates and check if they are going to expire soonfor cert in ssl_certs: expiration_date = cert['Expiration'] if (expiration_date - now) < expiration_threshold: print(f"The SSL client certificate {cert['ServerCertificateName']} is going to expire soon.")
Once you have identified the SSL client certificates that are going to expire soon, you need to rotate them. To rotate the SSL client certificates, you can use the following code snippet:
import boto3client = boto3.client('iam')# Get the list of SSL client certificatesssl_certs = client.list_server_certificates()['ServerCertificateMetadataList']# Loop through the SSL client certificates and rotate themfor cert in ssl_certs: certificate_name = cert['ServerCertificateName'] client.rotate_server_certificate(ServerCertificateName=certificate_name) print(f"The SSL client certificate {certificate_name} has been rotated.")
Finally, you can schedule a job to run this Python script periodically to ensure that the SSL client certificates are rotated before they expire. You can use AWS Lambda or any other scheduling service to run the script on a scheduled basis.
Note: Before running the script, ensure that you have the necessary permissions to access the SSL client certificates in AWS IAM.
