Description

Ensure that every Amazon API Gateway REST API uses the private endpoint type. A private REST API can only be called from your VPCs through an interface VPC endpoint (AWS PrivateLink), while edge-optimized and Regional REST APIs are reachable from the Internet.

Rationale

An API that is reachable from the Internet has a larger attack surface. Misconfigured or unauthenticated methods can leak data, unauthorized calls can change backend state, and bots or denial-of-service attacks can exhaust capacity and increase costs. Making internal APIs private keeps them off the Internet. If public access is required, the API should at least be restricted with a resource policy, protected with strong authentication (IAM, Amazon Cognito or Lambda authorizers), and covered by AWS WAF, throttling and logging.

Impact

  • Removes the API from the Internet, so it can only be reached from your VPCs through an interface VPC endpoint

  • Reduces exposure to data leaks, unauthorized calls and denial-of-service attacks

  • Clients outside your VPCs, including those using public custom domain names, will no longer be able to call the API

Default Value

New REST APIs created in the console use the Regional endpoint type, and REST APIs created with the API or AWS CLI without an endpoint configuration use the edge-optimized type. Both are publicly accessible. An API is private only if the Private endpoint type was explicitly selected.

Pre-Requisites

  • IAM permissions: apigateway:GET, apigateway:PATCH, apigateway:PUT and apigateway:POST (API Gateway administration)

  • An interface VPC endpoint for the execute-api service in each VPC that must call the API

  • A resource policy for the API that allows access from the required VPCs or VPC endpoints (private APIs cannot be invoked without one)

  • Confirmation from the application owner that no client needs to call the API from the Internet

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the API Gateway console and select APIs in the left menu.

  3. For each API of type REST, check the API endpoint type column (or the API endpoint type in the API's API settings).

  4. Repeat for each region in use.

  5. If any REST API has the endpoint type Edge-optimized or Regional, follow the implementation steps.

CLI:

List the REST APIs and their endpoint types:

aws apigateway get-rest-apis --region <REGION> --query "items[].[name,id,endpointConfiguration.types[0]]" --output table

A REST API fails if its endpoint type is anything other than PRIVATE (that is, EDGE or REGIONAL).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the API Gateway console and select the REST API.

  3. Select Resource policy and add a policy that allows access only from the required VPCs or VPC endpoints, then choose Save changes.

  4. Select API settings and choose Edit in API details.

  5. Set API endpoint type to Private and select the VPC endpoints that will call the API, if required.

  6. Choose Save changes.

  7. Select Resources and choose Deploy API to deploy the API to its stages so that the resource policy takes effect.

  8. Repeat for each public REST API in each region in use.

CLI:

Change the endpoint type to private. The path must name the current endpoint type (EDGE or REGIONAL) shown in the Test Plan output, not a list index:

aws apigateway update-rest-api --region <REGION> --rest-api-id <REST_API_ID> --patch-operations op=replace,path=/endpointConfiguration/types/REGIONAL,value=PRIVATE

Deploy the API to its stage so that the change and resource policy take effect:

aws apigateway create-deployment --region <REGION> --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME>

Backout Plan

Before making changes, save the current API settings:

aws apigateway get-rest-api --region <REGION> --rest-api-id <REST_API_ID> > rest-api-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the API Gateway console, select the REST API and select API settings.

  3. Choose Edit in API details and set API endpoint type to Regional.

  4. Choose Save changes.

  5. If needed, restore the previous resource policy from the saved backup and deploy the API again.

CLI:

aws apigateway update-rest-api --region <REGION> --rest-api-id <REST_API_ID> --patch-operations op=replace,path=/endpointConfiguration/types/PRIVATE,value=REGIONAL

Note: a private API can only be changed back to Regional, not directly to Edge-optimized. Rolling back makes the API reachable from the Internet again.

Reference