Public API must have authorization

문서 > 코드 분석 > Static Analysis Rules > Public API must have authorization

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: terraform-aws/public-api-no-authorization

Language: Terraform

Severity: Warning

Category: Security

Description

This rule mandates that all public APIs must have an authorization mechanism in place. The authorization attribute in the aws_api_gateway_method resource determines the authorization type for the API method. When it’s set to “NONE”, it means that the API is public and can be accessed by anyone, which is a major security risk.

The importance of this rule lies in its potential to prevent unauthorized access to your APIs. APIs often provide a gateway to sensitive information and systems, and leaving them unprotected can lead to data breaches, system disruptions, and other serious issues.

To avoid violating this rule, always ensure that your APIs have an appropriate level of authorization. In the AWS API Gateway, for instance, you can set the authorization to “AWS_IAM” to use AWS Identity and Access Management (IAM) for authorization. This ensures that only authenticated and authorized users can access your APIs. Here is an example of how to do this: resource "aws_api_gateway_method" "compliantapi" { authorization = "AWS_IAM" http_method = "GET" }. Always ensure to review the authorization settings of your APIs to conform to best security practices.

Non-Compliant Code Examples

resource "aws_api_gateway_method" "noncompliantapi" {
  authorization = "NONE"
  http_method   = "GET"
}

Compliant Code Examples

resource "aws_api_gateway_method" "compliantapi" {
  authorization = "AWS_IAM"
  http_method   = "GET"
}