API Gateway method does not contain an API key

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: 3641d5b4-d339-4bc2-bfb9-208fe8d3477f

Cloud Provider: AWS

Platform: CloudFormation

Severity: Medium

Category: Access Control

Learn More

Description

API Gateway methods must require an API key to prevent unauthenticated or uncontrolled usage that can lead to abuse, unexpected costs, or bypassing usage plans. For CloudFormation, AWS::ApiGateway::Method resources must define Properties.ApiKeyRequired and set it to true. Resources missing ApiKeyRequired or with ApiKeyRequired set to false will be flagged. Note that API keys help enforce usage plans and quotas but are not a substitute for strong authentication or authorization.

Secure configuration example:

MyMethod:
  Type: AWS::ApiGateway::Method
  Properties:
    RestApiId: !Ref MyApi
    ResourceId: !Ref MyResource
    HttpMethod: GET
    AuthorizationType: NONE
    ApiKeyRequired: true
    Integration:
      Type: MOCK

Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Description: ApiGateway
Resources:
  MockMethod:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      ApiKeyRequired: true
      RestApiId: !Ref MyApi
      ResourceId: !GetAtt
        - MyApi
        - RootResourceId
      HttpMethod: ""
      AuthorizationType: NONE
      Integration:
        Type: MOCK
      MethodResponses:
        - StatusCode : "200"

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "ApiGateway",
  "Resources": {
    "MockMethod": {
      "Type": "AWS::ApiGateway::Method",
      "Properties": {
        "Integration": {
          "Type": "MOCK"
        },
        "MethodResponses": [
          {
            "StatusCode": "200"
          }
        ],
        "ApiKeyRequired": true,
        "RestApiId": "MyApi",
        "ResourceId": [
          "MyApi",
          "RootResourceId"
        ],
        "HttpMethod": "",
        "AuthorizationType": "NONE"
      }
    }
  }
}

Non-Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Description: ApiGateway
Resources:
  MockMethod1:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      RestApiId: !Ref MyApi
      ResourceId: !GetAtt
        - MyApi
        - RootResourceId
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: MOCK
      MethodResponses:
        - StatusCode : "200"

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "ApiGateway",
  "Resources": {
    "MockMethod": {
      "Type": "AWS::ApiGateway::Method",
      "Properties": {
        "MethodResponses": [
          {
            "StatusCode": "200"
          }
        ],
        "ApiKeyRequired": false,
        "RestApiId": "MyApi",
        "ResourceId": [
          "MyApi",
          "RootResourceId"
        ],
        "HttpMethod": "GET",
        "AuthorizationType": "NONE",
        "Integration": {
          "Type": "MOCK"
        }
      }
    }
  }
}

{
  "Description": "ApiGateway",
  "Resources": {
    "MockMethod1": {
      "Type": "AWS::ApiGateway::Method",
      "Properties": {
        "ResourceId": [
          "MyApi",
          "RootResourceId"
        ],
        "HttpMethod": "GET",
        "AuthorizationType": "NONE",
        "Integration": {
          "Type": "MOCK"
        },
        "MethodResponses": [
          {
            "StatusCode": "200"
          }
        ],
        "RestApiId": "MyApi"
      }
    }
  },
  "AWSTemplateFormatVersion": "2010-09-09"
}