Description

Ensure that API Gateway REST API stages with response caching enabled have cache encryption at rest configured, so that cached response data stored by API Gateway is encrypted.

Rationale

API Gateway can cache backend responses at the stage level to improve latency and reduce backend load, but the cached data may include sensitive response payloads. Without encryption at rest enabled for the cache, this cached data is stored unencrypted, which does not meet the confidentiality expectations typically required for sensitive API responses.

Impact

  • Protects potentially sensitive cached API response data at rest

  • Supports compliance requirements mandating encryption of stored data

  • Introduces a modest additional latency overhead associated with encrypting/decrypting cache entries

Default Value

Cache encryption at rest is disabled by default when API caching is enabled for a stage.

Pre-Requisites

  • An API Gateway REST API stage with caching enabled

  • IAM permissions to update stage cache settings (apigateway:PATCH)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the REST API to review.

  3. Select Stages, then select the stage to review.

  4. Open the Settings tab and locate the Cache settings section.

  5. Verify that Encrypt cache data is enabled, if caching is enabled for this stage.

  6. If caching is enabled but encryption is not, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the REST API to update.

  3. Select Stages, then select the stage to update.

  4. Open the Settings tab and locate the Cache settings section.

  5. Select Edit, then enable Encrypt cache data.

  6. Save the changes.

  7. Verify the stage settings now reflect cache encryption as enabled.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the REST API to update.

  3. Select Stages, then select the affected stage.

  4. Open the Settings tab and locate the Cache settings section.

  5. Select Edit, then disable Encrypt cache data.

  6. Save the changes.



Reference