# Ensure API Gateway REST API Stage Cache Data is Encrypted at Rest

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890016694626-ensure-api-gateway-rest-api-stage-cache-data-is-encrypted-at-rest
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that API Gateway REST API stages with response caching enabled have cache encryption at rest configured, so that cached response data stored by API Gateway is encrypted.

**Rationale**

API Gateway can cache backend responses at the stage level to improve latency and reduce backend load, but the cached data may include sensitive response payloads. Without encryption at rest enabled for the cache, this cached data is stored unencrypted, which does not meet the confidentiality expectations typically required for sensitive API responses.

**Impact**

-   Protects potentially sensitive cached API response data at rest
    
-   Supports compliance requirements mandating encryption of stored data
    
-   Introduces a modest additional latency overhead associated with encrypting/decrypting cache entries
    

**Default Value**

Cache encryption at rest is disabled by default when API caching is enabled for a stage.

**Pre-Requisites**

-   An API Gateway REST API stage with caching enabled
    
-   IAM permissions to update stage cache settings (apigateway:PATCH)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to API Gateway and select the REST API to review.
    
3.  Select Stages, then select the stage to review.
    
4.  Open the Settings tab and locate the Cache settings section.
    
5.  Verify that Encrypt cache data is enabled, if caching is enabled for this stage.
    
6.  If caching is enabled but encryption is not, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to API Gateway and select the REST API to update.
    
3.  Select Stages, then select the stage to update.
    
4.  Open the Settings tab and locate the Cache settings section.
    
5.  Select Edit, then enable Encrypt cache data.
    
6.  Save the changes.
    
7.  Verify the stage settings now reflect cache encryption as enabled.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to API Gateway and select the REST API to update.
    
3.  Select Stages, then select the affected stage.
    
4.  Open the Settings tab and locate the Cache settings section.
    
5.  Select Edit, then disable Encrypt cache data.
    
6.  Save the changes.
    

  
  

**Reference**

-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.