Skip to main content

📝 AWS API Gateway REST API Stage is not associated with a WAF Web ACL 🟢

  • Contextual name: 📝 REST API Stage is not associated with a WAF Web ACL 🟢
  • ID: /ce/ca/aws/apigateway/rest-api-stage-waf-web-acl
  • Located in: 📁 AWS API Gateway

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

  • Internal
    • dec-x-bfdadcc4

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-bfdadcc41

Logic​

Description​

Open File

Description​

Associate AWS API Gateway REST API stages with a WAF Web ACL to provide enhanced security against web application threats. AWS WAF is a web application firewall designed to block, allow, or count web requests based on customizable rules and security conditions that you define. Linking your API Gateway stage with an AWS WAF Web ACL helps safeguard your APIs from common exploits, such as SQL injection and cross-site scripting (XSS), and other malicious activities targeting your APIs.

Rationale​

Configuring AWS WAF Web ACLs for API Gateway stages improves overall security posture by implementing rule-based traffic filtering. This measure defends against automated attacks, unauthorized access, and other malicious web activities. It also enables security teams to monitor and audit traffic patterns, allowing proactive adjustments to security configurations. Without a WAF Web ACL in place, APIs are vulnerable to various attack vectors, which could lead to unauthorized access, data breaches, and disruption of services.

... see more

Remediation​

Open File

Remediation​

From Command Line​

Associate an AWS WAF Web ACL with an API Gateway API Stage​

You can link an AWS WAF Web ACL to an API Gateway Stage by running the associate-web-acl command:

aws wafv2 associate-web-acl \
--web-acl-arn  {{web-acl-arn}} \
--resource-arn {{api-gateway-stage-arn}}

Replace {{web-acl-arn}} with the ARN of your Web ACL and {{api-gateway-stage-arn}} with the ARN of your API Gateway Stage.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 APRA CPG 234 → 💼 16a vulnerability and threat management;1111
💼 APRA CPG 234 → 💼 36g vulnerability management controls — which identify and address information security vulnerabilities in a timely manner;1111
💼 APRA CPG 234 → 💼 39a implement mechanisms that access and analyse timely threat intelligence regarding vulnerabilities, threats, methods of attack and countermeasures;1111
💼 APRA CPG 234 → 💼 39d implement mechanisms to disrupt the various phases of an attack. Example phases include reconnaissance, vulnerability exploitation, malware installation, privilege escalation, and unauthorised access1111
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [APIGateway.4] API Gateway should be associated with a WAF Web ACL11
💼 Cloudaware Framework → 💼 Threat Protection25
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1139
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)39
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3539
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet3537