API Gateway Cache Cluster Disabled
- Query id: 52790cad-d60d-41d5-8483-146f9f21208d
- Query name: API Gateway Cache Cluster Disabled
- Platform: CloudFormation
- Severity: Low
- Category: Insecure Configurations
- URL: Github
Description¶
AWS API Gateway should have cache clustering enabled
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
ProdPos1:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Prod
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
TracingEnabled: true
Variables:
Stack: Prod
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
Postitive test num. 2 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
ProdPos2:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Prod
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
TracingEnabled: true
Variables:
Stack: Prod
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
CacheClusterEnabled: false
Postitive test num. 3 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"ProdPos1": {
"Type": "AWS::ApiGateway::Stage",
"Properties": {
"StageName": "Prod",
"RestApiId": {
"Ref": "MyRestApi"
},
"DeploymentId": {
"Ref": "TestDeployment"
},
"DocumentationVersion": {
"Ref": "MyDocumentationVersion"
},
"ClientCertificateId": {
"Ref": "ClientCertificate"
},
"Variables": {
"Stack": "Prod"
},
"TracingEnabled": "true",
"MethodSettings": [
{
"ResourcePath": "/",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false"
},
{
"ResourcePath": "/stack",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "999"
},
{
"ResourcePath": "/stack",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "555"
}
]
}
}
}
}
Postitive test num. 4 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"ProdPos2": {
"Properties": {
"CacheClusterEnabled": false,
"ClientCertificateId": "ClientCertificate",
"DeploymentId": "TestDeployment",
"Description": "Prod Stage",
"DocumentationVersion": "MyDocumentationVersion",
"MethodSettings": [
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "999"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "555"
}
],
"RestApiId": "MyRestApi",
"StageName": "Prod",
"TracingEnabled": true,
"Variables": {
"Stack": "Prod"
}
},
"Type": "AWS::ApiGateway::Stage"
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
ProdNeg1:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Prod
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
TracingEnabled: true
Variables:
Stack: Prod
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
CacheClusterEnabled: true
Negative test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"ProdNeg1": {
"Properties": {
"CacheClusterEnabled": true,
"ClientCertificateId": "ClientCertificate",
"DeploymentId": "TestDeployment",
"Description": "Prod Stage",
"DocumentationVersion": "MyDocumentationVersion",
"MethodSettings": [
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "999"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "555"
}
],
"RestApiId": "MyRestApi",
"StageName": "Prod",
"TracingEnabled": true,
"Variables": {
"Stack": "Prod"
}
},
"Type": "AWS::ApiGateway::Stage"
}
}
}