API Gateway without WAF
- Query id: fcbf9019-566c-4832-a65c-af00d8137d2b
- Query name: API Gateway without WAF
- Platform: CloudFormation
- Severity: Medium
- Category: Networking and Firewall
- URL: Github
Description¶
API Gateway should have WAF (Web Application Firewall) enabled
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
Prod:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Prod
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
Variables:
Stack: Prod
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
SampleWebACLAssociation:
Type: 'AWS::WAFv2::WebACLAssociation'
Properties:
WebACLArn: ExampleARNForWebACL
ResourceArn: arn:aws:apigateway:region::/restapis/api-id/stages/stage
Postitive test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"Prod": {
"Properties": {
"ClientCertificateId": "ClientCertificate",
"DeploymentId": "TestDeployment",
"Description": "Prod Stage",
"DocumentationVersion": "MyDocumentationVersion",
"MethodSettings": [
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "999"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "555"
}
],
"RestApiId": "MyRestApi",
"StageName": "Prod",
"Variables": {
"Stack": "Prod"
}
},
"Type": "AWS::ApiGateway::Stage"
},
"SampleWebACLAssociation": {
"Properties": {
"ResourceArn": "arn:aws:apigateway:region::/restapis/api-id/stages/stage",
"WebACLArn": "ExampleARNForWebACL"
},
"Type": "AWS::WAFv2::WebACLAssociation"
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
Production:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Production
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
Variables:
Stack: Production
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
SampleWebACLAssociation:
Type: 'AWS::WAFv2::WebACLAssociation'
Properties:
WebACLArn: ExampleARNForWebACL
ResourceArn: arn:aws:apigateway:region::/restapis/api-id/stages/Production
Negative test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"Production": {
"Properties": {
"ClientCertificateId": "ClientCertificate",
"DeploymentId": "TestDeployment",
"Description": "Prod Stage",
"DocumentationVersion": "MyDocumentationVersion",
"MethodSettings": [
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "999"
},
{
"DataTraceEnabled": "false",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"ResourcePath": "/stack",
"ThrottlingBurstLimit": "555"
}
],
"RestApiId": "MyRestApi",
"StageName": "Production",
"Variables": {
"Stack": "Production"
}
},
"Type": "AWS::ApiGateway::Stage"
},
"SampleWebACLAssociation": {
"Properties": {
"ResourceArn": "arn:aws:apigateway:region::/restapis/api-id/stages/Production",
"WebACLArn": "ExampleARNForWebACL"
},
"Type": "AWS::WAFv2::WebACLAssociation"
}
}
}