Skip to main content

AppSync APIs Should Have Authorization Configuration

More Info:​

This rule evaluates the authorization configuration of AWS AppSync APIs to ensure that appropriate access controls are in place. It verifies whether authentication modes such as API key, IAM, or Cognito user pools are properly configured and whether authorization mechanisms such as fine-grained resolver permissions or GraphQL field-level security are implemented to restrict access to sensitive data.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Check Cause​

Using Console
  1. Sign in to the AWS Management Console.
  2. Navigate to the AWS AppSync service by typing 'AppSync' into the search bar and selecting it from the dropdown menu.
  3. Once in the AppSync dashboard, you will see a list of your APIs. Click on the name of the API you want to check.
  4. In the settings of the selected API, look for the 'Authorization' section. Here, you should see the authorization type and additional authorization providers if any have been configured. If there is no authorization configuration, it indicates a misconfiguration.
Using CLI
  1. First, you need to list all the available AppSync APIs. You can do this by using the AWS CLI command list-graphql-apis. The command is as follows:
aws appsync list-graphql-apis --region <region-name>

Replace <region-name> with the name of the AWS region where the APIs are hosted.

  1. The output of the above command will give you a list of all the AppSync APIs in the specified region. Each API will have an 'arn' and 'name'. You can use the 'arn' to get more details about each API.

  2. Now, for each API, you need to check the authorization configuration. You can do this by using the AWS CLI command get-graphql-api. The command is as follows:

aws appsync get-graphql-api --api-id <api-id> --region <region-name>

Replace <api-id> with the 'arn' of the API you want to check and <region-name> with the name of the AWS region where the API is hosted.

  1. The output of the above command will give you details about the specified API. Look for the 'authorizationConfig' field in the output. If this field is missing or not properly configured, then the API does not have proper authorization configuration.
Using Python

  1. Install and configure AWS SDK for Python (Boto3): Before you can start writing Python scripts to check AppSync APIs, you need to install and configure Boto3. You can install it using pip:

    pip install boto3

    Then, configure your AWS credentials either by setting the following environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN (optional), or by using the AWS CLI command aws configure.

  2. Import the necessary modules and create an AppSync client: In your Python script, you need to import Boto3 and create an AppSync client. Here's how you can do it:

    import boto3

    client = boto3.client('appsync')

  3. List all AppSync APIs and check their authorization configuration: You can use the list_graphql_apis method to get a list of all AppSync APIs. Then, for each API, you can use the get_graphql_api method to get its details and check its authorization configuration. Here's a sample script:

    import boto3

    client = boto3.client('appsync')

    # List all AppSync APIs
    response = client.list_graphql_apis()

    for api in response['graphqlApis']:
        # Get the details of each API
        api_response = client.get_graphql_api(
            apiId=api['apiId']
        )

        # Check the authorization configuration
        if 'authorizationConfig' not in api_response['graphqlApi']:
            print(f"AppSync API {api['name']} does not have an authorization configuration.")

  4. Handle pagination: The list_graphql_apis method returns a maximum of 25 APIs at a time. If you have more APIs, you need to handle pagination by using the nextToken parameter. Here's how you can modify the above script to handle pagination:

    import boto3

    client = boto3.client('appsync')

    # Initialize the next token
    next_token = None

    while True:
        # List all AppSync APIs
        if next_token:
            response = client.list_graphql_apis(nextToken=next_token)
        else:
            response = client.list_graphql_apis()

        for api in response['graphqlApis']:
            # Get the details of each API
            api_response = client.get_graphql_api(
                apiId=api['apiId']
            )

            # Check the authorization configuration
            if 'authorizationConfig' not in api_response['graphqlApi']:
                print(f"AppSync API {api['name']} does not have an authorization configuration.")

        # If there are more APIs, get the next token, otherwise break the loop
        if 'nextToken' in response:
            next_token = response['nextToken']
        else:
            break

This script will print the names of all AppSync APIs that do not have an authorization configuration.

Additional Reading:​