ACM Certificates Should Have Minimum RSA Length
More Info:
Ensure ACM certificate RSA length is mminimum of 2048Risk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Check Cause
Using Console
Using Console
- Sign in to the AWS Management Console.
- Navigate to the API Gateway console. You can do this by typing “API Gateway” into the search bar and selecting it from the dropdown menu.
- Once in the API Gateway console, select the API you want to check.
- In the API’s settings, look for the ACM Certificate section. Here, you can see the RSA length of the certificate. If the RSA length is less than the minimum required length, then there is a misconfiguration.
Using CLI
Using CLI
-
First, you need to list all the API Gateways in your AWS account. You can do this by using the following AWS CLI command:
Replace ‘your-region’ with the region you want to check. This command will return a list of all the API Gateways in the specified region.
-
Next, for each API Gateway, you need to get the details of the associated ACM certificate. You can do this by using the following AWS CLI command:
This command will return a list of all the domain names associated with each API Gateway. Each domain name will have an associated ACM certificate.
-
Now, for each ACM certificate, you need to get the details of the certificate. You can do this by using the following AWS CLI command:
Replace ‘your-certificate-arn’ with the ARN of the certificate you want to check. This command will return the details of the specified certificate.
- Finally, you need to check the RSA length of the certificate. You can do this by looking at the ‘KeyAlgorithm’ field in the output of the previous command. If the ‘KeyAlgorithm’ field is ‘RSA_2048’, then the RSA length of the certificate is 2048 bits. If the ‘KeyAlgorithm’ field is ‘RSA_1024’, then the RSA length of the certificate is 1024 bits. If the RSA length is less than 2048 bits, then the certificate is misconfigured.
Using Python
Using Python
-
Install the necessary Python libraries: Before you start, make sure you have the necessary Python libraries installed. You will need ‘boto3’ for AWS SDK for Python and ‘botocore’ for low-level, core functionality of AWS SDK for Python. You can install these libraries using pip:
-
Import the necessary libraries and initialize the AWS service: Import the necessary Python libraries and initialize the AWS service you want to use. In this case, we are using ‘boto3’ to interact with AWS API Gateway and ACM (AWS Certificate Manager).
-
Get the list of API Gateways and their associated ACM Certificates: Use the ‘get_rest_apis’ function to get the list of API Gateways. Then, for each API Gateway, get the associated ACM Certificate using the ‘get_domain_name’ function.
-
Check the RSA length of the ACM Certificate: The RSA length of the ACM Certificate can be found in the ‘KeyAlgorithm’ field of the certificate description. If the RSA length is less than the minimum required length, print a warning message.