# Ensure API Gateway stage cache encryption is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292229393861-ensure-api-gateway-stage-cache-encryption-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon API Gateway REST API stage that uses caching has cache data encryption enabled. API caching stores endpoint responses so that repeated requests can be served without calling the backend, and these cached responses should be encrypted at rest.

**Rationale**

Cached responses can contain sensitive data such as personal information, tokens or business data. If the cache is not encrypted, this data could be exposed if the underlying storage is accessed outside normal controls, which harms confidentiality and may allow replay or session hijacking. Enabling cache encryption, limiting who can administer stages, and avoiding caching of sensitive endpoints reduce this risk.

**Impact**

-   Protects cached API responses at rest
    
-   Helps meet compliance requirements for encryption of stored data
    
-   No change is needed in API clients; requests and responses are unchanged
    

**Default Value**

API caching is disabled by default. When caching is enabled, cache data is not encrypted unless **Encrypt cache data** is selected.

**Pre-Requisites**

-   IAM permissions: apigateway:GET and apigateway:PATCH on the REST API stages
    
-   A list of the REST APIs and stages that have caching enabled
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console and select a REST API.
    
3.  Select **Stages** and select a stage.
    
4.  Check whether caching is enabled for the stage or any method override, and if so whether **Encrypt cache data** is selected.
    
5.  Repeat for each stage of each REST API in each region in use.
    
6.  If caching is enabled but cache data is not encrypted, follow the implementation steps.
    

**CLI:**

List the REST APIs:

aws apigateway get-rest-apis --region <REGION> --query "items\[\].\[id,name\]" --output table

Show the cache settings of each stage of an API:

aws apigateway get-stages --region <REGION> --rest-api-id <REST\_API\_ID> --query "item\[\].{Stage:stageName,CacheCluster:cacheClusterEnabled,MethodSettings:methodSettings}" --output json

A stage is evaluated only if at least one entry in methodSettings has cachingEnabled set to true. It fails if none of the entries with caching enabled has cacheDataEncrypted set to true.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console and select the REST API.
    
3.  Select **Stages** and select the affected stage.
    
4.  In the stage's cache settings (stage settings or **Method overrides**), select **Encrypt cache data**.
    
5.  Choose **Save**.
    
6.  Repeat for each affected stage in each region in use.
    

**CLI:**

Enable cache data encryption for all methods of the stage:

aws apigateway update-stage --region <REGION> --rest-api-id <REST\_API\_ID> --stage-name <STAGE\_NAME> --patch-operations "op=replace,path=/\*/\*/caching/dataEncrypted,value=true"

**Backout Plan**

Before making changes, save the current stage settings:

aws apigateway get-stage --region <REGION> --rest-api-id <REST\_API\_ID> --stage-name <STAGE\_NAME> > <STAGE\_NAME>-stage-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the API Gateway console, select the REST API and select **Stages**.
    
3.  Select the stage and clear **Encrypt cache data** in its cache settings.
    
4.  Choose **Save**.
    

**CLI:**

aws apigateway update-stage --region <REGION> --rest-api-id <REST\_API\_ID> --stage-name <STAGE\_NAME> --patch-operations "op=replace,path=/\*/\*/caching/dataEncrypted,value=false"

Note: rolling back leaves cached API responses unencrypted at rest.

**Reference**

-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-caching.html)
    
-   [https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-5](https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html#apigateway-5)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-stage.html](https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-stage.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.