Description

Ensure that routes on an API Gateway V2 (HTTP API or WebSocket API) are protected by an appropriate authorizer, such as a JWT authorizer, a Lambda authorizer, or IAM authorization, rather than being left open to unauthenticated invocation.

Rationale

An HTTP API or WebSocket API route without an authorizer accepts requests from any caller without verifying identity or authorization, which is appropriate only for genuinely public, unauthenticated endpoints. For routes that expose business logic, data, or perform state-changing operations, the absence of an authorizer means anyone who discovers the endpoint URL can invoke it, potentially exposing sensitive data or allowing unauthorized actions.

Impact

  • Ensures only authenticated and authorized callers can invoke protected routes

  • Reduces the risk of unauthorized data access or abuse of API functionality

  • Requires clients to be updated to supply valid credentials/tokens if an authorizer is newly added to a previously open route

Default Value

Routes on a newly created API Gateway V2 API have no authorizer configured by default and are open to any caller unless one is explicitly attached.

Pre-Requisites

  • An identity provider (for JWT authorizers) or a Lambda function (for Lambda authorizers) to perform authorization

  • IAM permissions to create and attach authorizers (apigateway:POST, apigateway:PATCH)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the HTTP API or WebSocket API to review.

  3. Select Routes and review each route's configuration.

  4. For each route that is not intentionally public, verify that an authorizer (JWT, Lambda, or IAM) is attached under Attach authorizers.

  5. If a route handling sensitive data or actions has no authorizer, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the HTTP or WebSocket API to update.

  3. Select Authorization (or Authorizers) and select Create and attach an authorizer.

  4. Choose the authorizer type (JWT, Lambda, or IAM) and configure the required settings, such as the issuer URL and audience for JWT, or the Lambda function ARN for a Lambda authorizer.

  5. Select the routes that should be protected and attach the authorizer to them.

  6. Save the configuration and redeploy the stage if required.

  7. Test that unauthenticated requests are now rejected and that requests with valid credentials succeed.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the HTTP or WebSocket API to update.

  3. Select Routes, select the affected route, and remove the attached authorizer.

  4. Save the configuration and redeploy the stage if required.

Reference