# Ensure API Gateway REST APIs require authorization

- Source: https://support.icompaas.com/support/solutions/articles/a_1793286570289803-ensure-api-gateway-rest-apis-require-authorization
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon API Gateway REST API controls who can call it. An API is compliant if at least one authorizer is defined on the API, whether or not any method uses it, or if the API has at least one method and every method other than OPTIONS has an authorization type other than NONE. An API with no authorizer that has a method set to NONE, or that has no methods at all, is flagged. Methods with authorization set to NONE can be called by anyone without authentication.

**Rationale**

API methods without authorization allow anyone who knows the endpoint to read data, trigger backend actions and generate traffic. Attackers can discover such endpoints and call them without any credentials, leading to data exposure, unauthorized changes and unexpected costs or outages. Using IAM authorization, Amazon Cognito user pools or Lambda authorizers ensures that only authenticated and permitted callers can use the API.

**Impact**

-   Prevents unauthenticated access to API methods and the backends behind them
    
-   Allows access to be limited to specific users, applications or roles
    
-   Existing clients must be updated to send valid credentials or tokens, otherwise their requests will be rejected
    

**Default Value**

New API Gateway REST API methods are created with authorization set to NONE, and no authorizers are configured.

**Pre-Requisites**

-   IAM permissions: apigateway:GET, apigateway:POST, apigateway:PATCH (API Gateway administration)
    
-   The chosen authentication method: IAM, an Amazon Cognito user pool or a Lambda authorizer function
    
-   A plan for updating API clients to send the required credentials or tokens
    

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console and select a REST API.
    
3.  Select **Authorizers** in the left menu and check whether any authorizer is configured.
    
4.  If no authorizer exists, select **Resources** and open each method other than **OPTIONS**. Check the **Authorization** value in **Method request**.
    
5.  Repeat for each REST API in each region in use.
    
6.  If the API has no authorizer and either any method other than **OPTIONS** has authorization **NONE** or the API has no methods other than **OPTIONS**, follow the implementation steps.
    

**CLI:**

List the authorizers of an API:

aws apigateway get-authorizers --region <REGION> --rest-api-id <REST\_API\_ID> --query "items\[\].\[name,type\]" --output table

List the authorization type of each method:

aws apigateway get-resources --region <REGION> --rest-api-id <REST\_API\_ID> --embed methods --query "items\[\].{Path:path,Methods:resourceMethods.\*.\[httpMethod,authorizationType\]}" --output json

OPTIONS methods are ignored. The API fails if it has no authorizers and any other method has authorization type NONE, or if it has no authorizers and no methods other than OPTIONS. It passes only if at least one authorizer is defined on the API, whether or not any method uses it, or if it has at least one non-OPTIONS method and every such method has an authorization type other than NONE.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console and select the REST API.
    
3.  If using Cognito or a Lambda function, select **Authorizers**, choose **Create authorizer**, enter the details and choose **Create authorizer**.
    
4.  Select **Resources**, then select a method (for example, **GET**).
    
5.  In **Method request**, choose **Edit**.
    
6.  Set **Authorization** to **AWS IAM** or to the authorizer created in step 3, then choose **Save**.
    
7.  Repeat for every method that shows authorization **NONE**.
    
8.  Choose **Deploy API**, select the stage and choose **Deploy** to apply the changes.
    
9.  Repeat for each affected REST API in each region in use.
    

**Backout Plan**

Before making changes, note the current deployment ID of the stage:

aws apigateway get-stage --rest-api-id <REST\_API\_ID> --stage-name <STAGE\_NAME> --query deploymentId

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console, select the REST API and select **Stages**.
    
3.  Select the stage, open **Deployment history**, select the previous deployment and choose **Change active deployment**.
    

**CLI:**

aws apigateway update-stage --rest-api-id <REST\_API\_ID> --stage-name <STAGE\_NAME> --patch-operations op=replace,path=/deploymentId,value=<PREVIOUS\_DEPLOYMENT\_ID>

Note: rolling back makes the methods callable without authentication again. Use it only as a temporary measure.

**Reference**

-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html)
    
-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html)
    
-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-method.html](https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-method.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.