To remediate the misconfiguration “Only Private Endpoints Should Access APIs” for AWS using AWS CLI, follow the below steps:

1. Identify the APIs that are publicly accessible by running the following command:

aws apigateway get-rest-apis --query "items[?endpointConfiguration.types[0]=='EDGE'].name"

This command will list all the APIs that are publicly accessible via the internet.

2. For each of the APIs identified in step 1, update the endpoint configuration to make it private by running the following command:

aws apigateway update-rest-api --rest-api-id <rest-api-id> --patch-operations op=replace,path=/endpointConfiguration/types/0,value=PRIVATE

Replace <rest-api-id> with the ID of the API that you want to update.

3. Verify that the endpoint configuration has been updated by running the following command:

aws apigateway get-rest-api --rest-api-id <rest-api-id> --query "endpointConfiguration.types"

This command will return the endpoint configuration of the API. Verify that the first element in the array is “PRIVATE”.

4. Repeat steps 2 and 3 for all the APIs that were identified in step 1.

5. Once you have updated all the APIs, verify that they are no longer publicly accessible by running the following command:

aws apigateway get-rest-apis --query "items[?endpointConfiguration.types[0]=='EDGE'].name"

This command should not return any APIs.

To remediate the misconfiguration “Only Private End-Points Should Access APIs” in AWS using Python, you can follow the below steps:

Step 1: Identify the APIs which are not restricted to private endpoints only.

Step 2: For each API, check if it is currently accessible from a public endpoint.

Step 3: If the API is accessible from a public endpoint, restrict its access to private endpoints only.

Step 4: To restrict the access of an API to private endpoints only, you can use the following Python code:

import boto3

# Create a boto3 client for the API Gateway service
apigateway = boto3.client('apigateway')

# Get the ID of the API which you want to restrict to private endpoints only
api_id = 'your_api_id'

# Get the current settings of the API
response = apigateway.get_rest_api(restApiId=api_id)

# Check if the API is currently accessible from a public endpoint
if response['endpointConfiguration']['types'][0] == 'EDGE':
    # If the API is accessible from a public endpoint, restrict its access to private endpoints only
    apigateway.update_rest_api(
        restApiId=api_id,
        patchOperations=[
            {
                'op': 'replace',
                'path': '/endpointConfiguration/types/0',
                'value': 'PRIVATE'
            }
        ]
    )

Step 5: Run this code for all the APIs which are not restricted to private endpoints only.

By following these steps, you can remediate the misconfiguration “Only Private End-Points Should Access APIs” in AWS using Python.