​
More Info:

Your Amazon API Gateway APIs should be using SSL certificates to verify that HTTP requests made to your backend system are from API Gateway service.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

NIST

​
Triage and Remediation

​
Check Cause

Using Console

  1. Sign in to the AWS Management Console.
  2. Navigate to the API Gateway service by typing ‘API Gateway’ in the search bar and selecting it from the dropdown menu.
  3. In the API Gateway dashboard, you will see a list of all your APIs. Select the API you want to check.
  4. Once you’ve selected the API, navigate to the ‘Custom Domain Names’ section in the left-hand menu. Here, you can see if an SSL certificate is associated with your API. If there is no SSL certificate, or if it’s expired, then it’s a misconfiguration.
  1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the API Gateway services.
  2. Once the AWS CLI is set up, you can list all the APIs in the API Gateway by using the following command: 
    aws apigateway get-rest-apis
    This command will return a list of all the APIs in the API Gateway.
  3. To check if an API is using SSL certificates, you need to get the details of each API. You can do this by using the following command: 
    aws apigateway get-rest-api --rest-api-id {rest-api-id}
    Replace {rest-api-id} with the ID of the API you want to check. This command will return the details of the specified API.
  4. In the returned details, look for the endpointConfiguration field. If the types field under endpointConfiguration is set to EDGE, it means the API is using a CloudFront distribution and SSL certificates are managed by AWS. If the types field is set to REGIONAL or PRIVATE, you need to manually manage SSL certificates.
  1. Install the necessary Python libraries: Before you start, make sure you have the necessary Python libraries installed. You will need the boto3 library, which is the Amazon Web Services (AWS) SDK for Python. It allows Python developers to write software that makes use of services like Amazon S3, Amazon EC2, etc. You can install it using pip: 
    pip install boto3
  2. Configure AWS Credentials: You need to configure your AWS credentials. You can do this in several ways, but the simplest is to use the AWS CLI. Run aws configure and then enter your access key, secret access key, and default region when prompted.
  3. Python Script: Now you can use the following Python script to check if API Gateway APIs are using SSL certificates: 
    import boto3

def check_api_gateway_ssl():
    client = boto3.client('apigateway')
    response = client.get_rest_apis()
    for api in response['items']:
        api_id = api['id']
        api_name = api['name']
        response = client.get_stages(restApiId=api_id)
        for stage in response['item']:
            if 'clientCertificateId' not in stage:
                print(f"API Gateway '{api_name}' does not use SSL certificate.")
            else:
                print(f"API Gateway '{api_name}' uses SSL certificate.")

check_api_gateway_ssl()
    This script retrieves all the API Gateways and checks if they have a client certificate ID associated with them. If they don’t, it means they are not using SSL certificates.
  4. Run the Script: Finally, you can run the script using a Python interpreter. If any API Gateway is not using SSL certificates, it will be printed out. Please note that this script only checks for the existence of a client certificate ID, not whether the certificate is valid or expired. You may need to add additional checks depending on your requirements.

​
Additional Reading: