Skip to main content

🛡️ AWS API Gateway REST API auto-provisioning status🟢

  • Contextual name: 🛡️ API Gateway REST API auto-provisioning status🟢
  • ID: /ce/ca/automated-provisioning/aws-api-gateway-rest-api
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY

Stats​

not available

Logic​

Description​

Open File

Description​

Identify AWS API Gateway REST APIs that were provisioned through AWS CloudFormation or AWS Service Catalog.

This policy checks for AWS-reserved tags that identify an API Gateway REST API as a resource provisioned through AWS CloudFormation or AWS Service Catalog.

Rationale​

AWS-managed provisioning tags provide evidence that a REST API is associated with a CloudFormation stack or a Service Catalog provisioned product. This allows to distinguish APIs with supported AWS-managed provisioning indicators from APIs that are not identified by this tag-based method.

Audit​

This policy applies only to API Gateway records with the restApi record type.

It classifies an AWS API Gateway REST API as identified by automated provisioning evidence when the REST API has at least one of the following AWS-reserved tag keys:

  • aws:cloudformation:logical-id
  • aws:cloudformation:stack-id
  • aws:cloudformation:stack-name
  • aws:servicecatalog:portfolioArn
  • aws:servicecatalog:productArn
  • aws:servicecatalog:provisioningPrincipalArn

... see more

Remediation​

Open File

Review​

Acknowledge the REST API provisioning source and classify it according to how it is managed.

If the REST API was intentionally created or managed outside CloudFormation or Service Catalog, record the appropriate ownership and provisioning context. If the API should be managed through CloudFormation or Service Catalog, note the expected management approach for follow-up.

Do not attempt to add or edit aws: tags manually; AWS reserves this prefix and AWS-managed tag keys are not customer-editable. Retire the REST API if review confirms it is no longer required.

policy.yaml​

Open File