For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/cloudformation-aws-api-gateway-method-does-not-contain-an-api-key.md. A documentation index is available at /llms.txt.

API Gateway method does not contain an API key

This product is not supported for your selected Datadog site. ().

Metadata

Id: cloudformation-aws-api-gateway-method-does-not-contain-an-api-key

Provider: AWS

Platform: CloudFormation

Severity: Medium

Category: Access Control

Learn More

Description

API Gateway methods must require an API key to prevent unauthenticated or uncontrolled usage that can lead to abuse, unexpected costs, or bypassing usage plans. For CloudFormation, AWS::ApiGateway::Method resources must define Properties.ApiKeyRequired and set it to true. Resources missing ApiKeyRequired or with ApiKeyRequired set to false will be flagged. Note that API keys help enforce usage plans and quotas but are not a substitute for strong authentication or authorization.

Secure configuration example:

MyMethod:
  Type: AWS::ApiGateway::Method
  Properties:
    RestApiId: !Ref MyApi
    ResourceId: !Ref MyResource
    HttpMethod: GET
    AuthorizationType: NONE
    ApiKeyRequired: true
    Integration:
      Type: MOCK

Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Description: ApiGateway
Resources:
  MockMethod:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      ApiKeyRequired: true
      RestApiId: !Ref MyApi
      ResourceId: !GetAtt
        - MyApi
        - RootResourceId
      HttpMethod: ""
      AuthorizationType: NONE
      Integration:
        Type: MOCK
      MethodResponses:
        - StatusCode : "200"

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "ApiGateway",
  "Resources": {
    "MockMethod": {
      "Type": "AWS::ApiGateway::Method",
      "Properties": {
        "Integration": {
          "Type": "MOCK"
        },
        "MethodResponses": [
          {
            "StatusCode": "200"
          }
        ],
        "ApiKeyRequired": true,
        "RestApiId": "MyApi",
        "ResourceId": [
          "MyApi",
          "RootResourceId"
        ],
        "HttpMethod": "",
        "AuthorizationType": "NONE"
      }
    }
  }
}

Non-Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Description: ApiGateway
Resources:
  MockMethod:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      ApiKeyRequired: false
      RestApiId: !Ref MyApi
      ResourceId: !GetAtt
        - MyApi
        - RootResourceId
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: MOCK
      MethodResponses:
        - StatusCode : "200"

AWSTemplateFormatVersion: "2010-09-09"
Description: ApiGateway
Resources:
  MockMethod1:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      RestApiId: !Ref MyApi
      ResourceId: !GetAtt
        - MyApi
        - RootResourceId
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: MOCK
      MethodResponses:
        - StatusCode : "200"

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "ApiGateway",
  "Resources": {
    "MockMethod": {
      "Type": "AWS::ApiGateway::Method",
      "Properties": {
        "MethodResponses": [
          {
            "StatusCode": "200"
          }
        ],
        "ApiKeyRequired": false,
        "RestApiId": "MyApi",
        "ResourceId": [
          "MyApi",
          "RootResourceId"
        ],
        "HttpMethod": "GET",
        "AuthorizationType": "NONE",
        "Integration": {
          "Type": "MOCK"
        }
      }
    }
  }
}