Encryption At Rest Should Be Enabled For App Sync Cache

1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the AppSync resources.

2. Once the AWS CLI is set up, you can use the following command to list all the AppSync APIs in your account:

   aws appsync list-graphql-apis --region your-region
   

   Replace ‘your-region’ with the region where your resources are located. This command will return a list of all the AppSync APIs in the specified region.

3. To check the encryption at rest configuration for each API, you can use the following command:

   aws appsync get-graphql-api --api-id your-api-id --region your-region
   

   Replace ‘your-api-id’ with the ID of the API you want to check and ‘your-region’ with the region where the API is located. This command will return the details of the specified API, including the encryption at rest configuration.

4. To check if encryption at rest is enabled, you need to look at the ‘userPoolConfig’ field in the output. If the ‘awsCognitoUserPools’ field is set to ‘true’, then encryption at rest is enabled. If it’s set to ‘false’ or not present, then encryption at rest is not enabled.

   Note: The ‘awsCognitoUserPools’ field might not be present if the API is not using AWS Cognito User Pools for authorization. In this case, you need to check the ‘authorizationConfig’ field to see if encryption at rest is enabled.

To check if Encryption At Rest is enabled for App Sync Cache in AWS App Sync, you can use the AWS SDK for Python (Boto3). Here are the steps:

1. Set up AWS SDK for Python (Boto3): First, you need to install and configure Boto3. You can install it using pip:

   pip install boto3
   

   Then, configure your AWS credentials. You can do this by setting the following environment variables:

   AWS_ACCESS_KEY_ID = 'your_access_key'
   AWS_SECRET_ACCESS_KEY = 'your_secret_key'
   

2. Import Boto3 and Initialize AppSync Client: Now, you can import Boto3 in your Python script and initialize the AppSync client.

   import boto3
   
   client = boto3.client('appsync')
   

3. List AppSync APIs and Check Encryption Configuration: You can use the list_graphql_apis method to get a list of all AppSync APIs. Then, for each API, you can check the xrayEnabled attribute in the logConfig field to see if Encryption At Rest is enabled.

   response = client.list_graphql_apis()
   
   for api in response['graphqlApis']:
       if 'logConfig' in api and 'xrayEnabled' in api['logConfig']:
           if api['logConfig']['xrayEnabled']:
               print(f"Encryption At Rest is enabled for {api['name']}")
           else:
               print(f"Encryption At Rest is not enabled for {api['name']}")
   

4. Handle Pagination: The list_graphql_apis method returns a maximum of 25 APIs at a time. If you have more than 25 APIs, you need to handle pagination by using the nextToken parameter.

   next_token = None
   
   while True:
       if next_token:
           response = client.list_graphql_apis(nextToken=next_token)
       else:
           response = client.list_graphql_apis()
   
       for api in response['graphqlApis']:
           if 'logConfig' in api and 'xrayEnabled' in api['logConfig']:
               if api['logConfig']['xrayEnabled']:
                   print(f"Encryption At Rest is enabled for {api['name']}")
               else:
                   print(f"Encryption At Rest is not enabled for {api['name']}")
   
       if 'nextToken' in response:
           next_token = response['nextToken']
       else:
           break
   

Please note that this script assumes that you have the necessary permissions to list and describe AppSync APIs. If you don’t, you may need to adjust your IAM policies accordingly.