API Gateway Should Be Integrated With WAF

More Info:

AWS Web Application Firewall (WAF) should be integrated with API Gateway to protect your APIs from common web exploits such as SQLi attacks, XSS attacks and Cross-Site Request Forgery (CSRF) attacks.

Risk Level

Low

Address

Security

Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

Triage and Remediation

Check Cause

Using Console

Using CLI

List all API Gateways: First, you need to list all the API Gateways in your AWS account. You can do this by using the get-rest-apis command in AWS CLI. The command is as follows:
```
aws apigateway get-rest-apis --region your-region
```
Replace ‘your-region’ with the region of your AWS account. This command will return a list of all the API Gateways in your account.
Get the details of each API Gateway: For each API Gateway returned in the previous step, you need to get its details. You can do this by using the get-rest-api command in AWS CLI. The command is as follows:
```
aws apigateway get-rest-api --rest-api-id your-rest-api-id --region your-region
```
Replace ‘your-rest-api-id’ with the ID of the API Gateway and ‘your-region’ with the region of your AWS account. This command will return the details of the API Gateway.
Check if the API Gateway is integrated with WAF: In the details of the API Gateway returned in the previous step, look for the ‘webAclArn’ field. If this field is present and not empty, it means that the API Gateway is integrated with WAF.
Automate the process: You can automate the above steps by writing a script in Python using the Boto3 library. The script will use the get_rest_apis and get_rest_api methods of the boto3.client('apigateway') object to get the list of API Gateways and their details respectively. It will then check if the ‘webAclArn’ field is present and not empty for each API Gateway.

Using Python

Install the necessary Python libraries: Before you start, make sure you have the AWS SDK for Python (Boto3) installed, which allows you to write software that makes use of services like Amazon S3, Amazon EC2, etc.

pip install boto3

Establish a session: You need to establish a session using your AWS credentials.

import boto3

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY',
    aws_secret_access_key='YOUR_SECRET_KEY',
    aws_session_token='SESSION_TOKEN',
)

List all API Gateways: Use the get_rest_apis function to retrieve all the API Gateways.

client = session.client('apigateway')
response = client.get_rest_apis()

Check if WAF is integrated: For each API Gateway, check if it is integrated with WAF. You can do this by calling the get_web_acl_for_resource function from the WAF Regional client. If the API Gateway is not integrated with WAF, the function will throw an exception.

waf_client = session.client('waf-regional')

for api in response['items']:
    try:
        waf_response = waf_client.get_web_acl_for_resource(
            ResourceArn=api['id']
        )
        print(f"API Gateway {api['name']} is integrated with WAF")
    except Exception as e:
        print(f"API Gateway {api['name']} is not integrated with WAF")

This script will print out the names of all API Gateways and whether they are integrated with WAF. If an API Gateway is not integrated with WAF, it may be a misconfiguration.

Additional Reading:

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

API Gateway Should Be Integrated With WAF

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Additional Reading: