AWS Introduction
AWS Pricing
AWS Threats
AWS Misconfigurations
- Getting Started with AWS Audit
- Permissions required for Misconfigurations Detection
- API Gateway Audit
- Cloudformation Audit
- CloudFront Audit
- CloudTrail Audit
- Cloudwatch Audit
- DynamoDB Audit
- EC2 Audit
- Elastic Search Audit
- ELB Audit
- IAM Audit
- KMS Audit
- Kubernetes Audit
- Lambda Audit
- RDS Audit
- Redshift Audit
- Route53 Audit
- S3 Audit
- Security Groups Audit
- SES Audit
- SNS Audit
- IAM Deep Dive
- App Sync Audit
- Code Build Audit
- Open Search Audit
- Shield Audit
- SQS Audit
AWS ACM Certificates Not Valid
More Info:
Ensure that all the requests made during SSL/TLS certificate issue or renewal process are validated. These requests are managed within your account by the Amazon Certificate Manager (ACM), an AWS service that lets you provision, deploy and maintain SSL/TLS certificates for use with other AWS resources such as ELB load balancers, CloudFront distributions or APIs via Amazon API Gateway.
Risk Level
Medium
Address
Security
Compliance Standards
NIST
Triage and Remediation
Check Cause
-
Sign in to the AWS Management Console and open the API Gateway console at https://console.aws.amazon.com/apigateway/.
-
In the navigation pane, choose ‘APIs’.
-
In the APIs pane, choose the API you want to check.
-
In the API details pane, choose ‘Custom Domain Names’. This will display a list of custom domain names associated with the API.
-
For each custom domain name, check the ‘ACM Certificate’ column. If the certificate is not valid, it will be indicated here.
-
First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the resources.
-
Once the AWS CLI is set up, you can list all the API Gateways in your account using the following command:
aws apigateway get-rest-apis --region your-region-nameReplace ‘your-region-name’ with the name of your AWS region. This command will return a list of all the REST APIs in the specified region.
-
For each API Gateway, you can get the details of the API Gateway’s stages using the following command:
aws apigateway get-stages --rest-api-id your-rest-api-id --region your-region-nameReplace ‘your-rest-api-id’ with the ID of your REST API and ‘your-region-name’ with the name of your AWS region. This command will return a list of all the stages of the specified REST API.
-
For each stage, check the ‘clientCertificateId’ field. If this field is empty or the certificate ID is not valid, then the ACM Certificate is not valid in the API Gateway. You can check the validity of the certificate ID using the following command:
aws acm describe-certificate --certificate-arn your-certificate-arn --region your-region-nameReplace ‘your-certificate-arn’ with the ARN of your certificate and ‘your-region-name’ with the name of your AWS region. This command will return the details of the specified certificate. If the ‘Status’ field is not ‘ISSUED’, then the certificate is not valid.
- Install and configure AWS SDK for Python (Boto3) on your local system. This will allow you to interact with AWS services using Python.
pip install boto3
aws configure
- Import the necessary modules and create a session using your AWS credentials.
import boto3
session = boto3.Session(
aws_access_key_id='YOUR_ACCESS_KEY',
aws_secret_access_key='YOUR_SECRET_KEY',
region_name='YOUR_REGION'
)
- Use the
get_rest_apismethod from theapigatewayclient to get a list of all the APIs in your account. Then, for each API, use theget_domain_namesmethod to get a list of all the domain names associated with that API. For each domain name, check thecertificateUploadDateattribute. If it is more than 13 months ago, the certificate is not valid.
client = session.client('apigateway')
apis = client.get_rest_apis()['items']
for api in apis:
domain_names = client.get_domain_names()['items']
for domain_name in domain_names:
if 'certificateUploadDate' in domain_name:
certificate_age = (datetime.datetime.now(datetime.timezone.utc) - domain_name['certificateUploadDate']).days
if certificate_age > 395:
print(f"API Gateway {api['name']} has an invalid certificate for domain {domain_name['domainName']}")
- This script will print out the names of all the APIs and their associated domain names that have invalid certificates. You can modify this script to suit your needs, for example by sending an email alert instead of printing to the console.