Description

Ensure that stage variables configured on API Gateway REST API stages do not contain sensitive values such as passwords, API keys, tokens, or other secrets, since stage variables are stored in plaintext and are visible to anyone with read access to the API's configuration.

Rationale

Stage variables are commonly used to parameterize backend endpoints, Lambda function aliases, or other configuration values per stage, but they are not designed as a secure secrets store; their values are visible in the console and via the API to any principal with API Gateway read permissions, and may also appear in exported configuration, logs, or infrastructure-as-code state. Storing secrets in stage variables risks broad, unintended exposure of sensitive credentials.

Impact

  • Prevents unintended exposure of secrets to principals with API Gateway read access

  • Encourages the use of a proper secrets management solution such as AWS Secrets Manager or Systems Manager Parameter Store

  • Requires updating integration configurations (Lambda code, backend calls) to retrieve secrets from a secure store instead of stage variables

Default Value

API Gateway does not restrict what values can be stored in a stage variable; there is no default protection against storing secrets there.

Pre-Requisites

  • An approved secrets management solution (AWS Secrets Manager or Systems Manager Parameter Store) available in the account

  • IAM permissions to view and update stage variables (apigateway:GET, apigateway:PATCH) and to create secrets (secretsmanager:CreateSecret)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the REST API to review.

  3. Select Stages, then select the stage to review.

  4. Open the Stage Variables tab.

  5. Review each stage variable's name and value for anything resembling a password, API key, token, or connection string containing credentials.

  6. If any stage variable appears to contain a secret, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Secrets Manager (or Systems Manager Parameter Store) and create a secret containing the sensitive value currently stored in the stage variable.

  3. Update the backend integration (for example, the Lambda function or backend service) to retrieve the value from Secrets Manager or Parameter Store at runtime, using an IAM role with the minimum required permissions.

  4. Navigate to API Gateway, select the REST API, then Stages, then the affected stage.

  5. Open the Stage Variables tab, select the variable containing the secret, and delete it (or replace its value with a non-sensitive reference, such as a secret name/ARN rather than the secret value itself).

  6. Deploy the updated integration and verify functionality with the secret now sourced from the secure store.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway, select the REST API, then Stages, then the affected stage.

  3. Open the Stage Variables tab and select Add stage variable.

  4. Re-enter the previous variable name and value if reverting is required.

  5. Save the changes.

Reference