Description

Ensure that every stage of each Amazon API Gateway REST API has an AWS WAF web ACL associated with it. The web ACL inspects incoming requests and blocks or allows them based on the rules it contains, before they reach the API.

Rationale

Without a web ACL, an API is exposed to application-layer attacks such as SQL injection, cross-site scripting, parameter tampering, bot abuse and request floods. These attacks can lead to data exposure, unauthorized changes and loss of availability, and APIs with public endpoints are at the highest risk. Associating a web ACL that uses AWS managed rule groups, rate-based rules and tailored allow or deny lists adds a layer of defense in front of the API.

Impact

  • Filters malicious requests before they reach the API and its backend

  • Allows rate limiting of abusive clients

  • Rules that are too strict may block legitimate requests, so new rules should be tested (for example in Count mode) before they block traffic

  • AWS WAF is charged per web ACL, per rule and per request inspected

Default Value

API Gateway stages have no AWS WAF web ACL associated by default.

Pre-Requisites

  • IAM permissions: apigateway:GET, wafv2:ListWebACLs, wafv2:GetWebACLForResource, wafv2:AssociateWebACL, wafv2:DisassociateWebACL and apigateway:SetWebACL

  • A web ACL with scope Regional in the same region as the API, or permission to create one (wafv2:CreateWebACL)

  • Agreement with the application owner on the rules to apply

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the API Gateway console and select a REST API.

  3. Select Stages and select a stage.

  4. In Stage details, check the Web ACL value.

  5. Repeat for each stage of each REST API in each region in use.

  6. If no web ACL is associated with a stage, follow the implementation steps.

CLI:

List the stages of an API and their associated web ACL:

aws apigateway get-stages --region <REGION> --rest-api-id <REST_API_ID> --query "item[].[stageName,webAclArn]" --output table

A stage fails if webAclArn is empty (shown as None).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS WAF console and select Web ACLs.

  3. Select the region of the API and choose the web ACL to use (or create a Regional web ACL with the required rules).

  4. Open the Associated AWS resources tab and choose Add AWS resources.

  5. Select Amazon API Gateway REST API as the resource type, then select the API stage.

  6. Choose Add.

  7. Repeat for each stage of each REST API in each region in use.

CLI:

Associate the web ACL with the API stage:

aws wafv2 associate-web-acl --region <REGION> --web-acl-arn <WEB_ACL_ARN> --resource-arn arn:aws:apigateway:<REGION>::/restapis/<REST_API_ID>/stages/<STAGE_NAME>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS WAF console, select Web ACLs and select the region of the API.

  3. Select the web ACL and open the Associated AWS resources tab.

  4. Select the API stage and choose Disassociate.

CLI:

aws wafv2 disassociate-web-acl --region <REGION> --resource-arn arn:aws:apigateway:<REGION>::/restapis/<REST_API_ID>/stages/<STAGE_NAME>

Note: rolling back removes the WAF protection from the API stage. If legitimate requests are being blocked, consider switching the affected rule to Count mode instead.

Reference