Description

Ensure that every Amazon API Gateway REST API stage that uses caching has cache data encryption enabled. API caching stores endpoint responses so that repeated requests can be served without calling the backend, and these cached responses should be encrypted at rest.

Rationale

Cached responses can contain sensitive data such as personal information, tokens or business data. If the cache is not encrypted, this data could be exposed if the underlying storage is accessed outside normal controls, which harms confidentiality and may allow replay or session hijacking. Enabling cache encryption, limiting who can administer stages, and avoiding caching of sensitive endpoints reduce this risk.

Impact

  • Protects cached API responses at rest

  • Helps meet compliance requirements for encryption of stored data

  • No change is needed in API clients; requests and responses are unchanged

Default Value

API caching is disabled by default. When caching is enabled, cache data is not encrypted unless Encrypt cache data is selected.

Pre-Requisites

  • IAM permissions: apigateway:GET and apigateway:PATCH on the REST API stages

  • A list of the REST APIs and stages that have caching enabled

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the API Gateway console and select a REST API.

  3. Select Stages and select a stage.

  4. Check whether caching is enabled for the stage or any method override, and if so whether Encrypt cache data is selected.

  5. Repeat for each stage of each REST API in each region in use.

  6. If caching is enabled but cache data is not encrypted, follow the implementation steps.

CLI:

List the REST APIs:

aws apigateway get-rest-apis --region <REGION> --query "items[].[id,name]" --output table

Show the cache settings of each stage of an API:

aws apigateway get-stages --region <REGION> --rest-api-id <REST_API_ID> --query "item[].{Stage:stageName,CacheCluster:cacheClusterEnabled,MethodSettings:methodSettings}" --output json

A stage is evaluated only if at least one entry in methodSettings has cachingEnabled set to true. It fails if none of the entries with caching enabled has cacheDataEncrypted set to true.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the API Gateway console and select the REST API.

  3. Select Stages and select the affected stage.

  4. In the stage's cache settings (stage settings or Method overrides), select Encrypt cache data.

  5. Choose Save.

  6. Repeat for each affected stage in each region in use.

CLI:

Enable cache data encryption for all methods of the stage:

aws apigateway update-stage --region <REGION> --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME> --patch-operations "op=replace,path=/*/*/caching/dataEncrypted,value=true"

Backout Plan

Before making changes, save the current stage settings:

aws apigateway get-stage --region <REGION> --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME> > <STAGE_NAME>-stage-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the API Gateway console, select the REST API and select Stages.

  3. Select the stage and clear Encrypt cache data in its cache settings.

  4. Choose Save.

CLI:

aws apigateway update-stage --region <REGION> --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME> --patch-operations "op=replace,path=/*/*/caching/dataEncrypted,value=false"

Note: rolling back leaves cached API responses unencrypted at rest.

Reference