API Gateway endpoint config is not private

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-aws-api-gateway-endpoint-config-is-not-private

Provider: AWS

Platform: Ansible

Severity: Medium

Category: Networking and Firewall

Learn More

Description

API Gateway endpoint type must be set to PRIVATE to prevent the API from being exposed to the public internet, which increases attack surface and can enable unauthorized access or data exfiltration.

For Ansible tasks using the community.aws.api_gateway or api_gateway modules, the endpoint_type property must be defined and set to PRIVATE. Tasks missing this property or with endpoint_type not set to PRIVATE are flagged. A PRIVATE endpoint restricts access to VPC endpoints, so ensure the required VPC endpoint and networking is configured to allow authorized clients to reach the API.

Secure Ansible task example:

- name: Create private API Gateway
  community.aws.api_gateway:
    name: my-private-api
    endpoint_type: PRIVATE
    state: present

Compliant Code Examples

- name: Setup AWS API Gateway setup on AWS and deploy API definition
  community.aws.api_gateway:
    name: my-private-api
    swagger_file: my_api.yml
    stage: production
    cache_enabled: true
    cache_size: '1.6'
    tracing_enabled: true
    endpoint_type: PRIVATE
    state: present

Non-Compliant Code Examples

- name: Setup AWS API Gateway setup on AWS and deploy API definition
  community.aws.api_gateway:
    name: my-edge-api
    swagger_file: my_api.yml
    stage: production
    cache_enabled: true
    cache_size: '1.6'
    tracing_enabled: true
    endpoint_type: EDGE
    state: present