Skip to main content

🛡️ AWS API Gateway REST API Stage is not associated with a WAF Web ACL🟢

Logic​

Similar Policies​

  • Internal: dec-x-bfdadcc4

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-bfdadcc41

Description​

Open File

Description​

Associate AWS API Gateway REST API stages with a WAF Web ACL to provide enhanced security against web application threats. AWS WAF is a web application firewall designed to block, allow, or count web requests based on customizable rules and security conditions that you configure. Linking your API Gateway stages to an AWS WAF Web ACL helps safeguard APIs from common exploits such as SQL injection and cross-site scripting (XSS), and other malicious activity targeting your APIs.

Rationale​

Configuring AWS WAF Web ACLs for API Gateway stages improves security posture by implementing rule-based traffic filtering. This measure defends against automated attacks, unauthorized access, and other malicious web activities. It also enables security teams to monitor and audit traffic patterns, allowing proactive adjustments to security rules. Without a WAF Web ACL in place, APIs are vulnerable to various attack vectors that could lead to unauthorized access, data breaches, and service disruption.

Impact​

AWS WAF pricing includes charges for the number of Web ACLs created, the number of rules within those ACLs, and the volume of web requests inspected. It is essential to evaluate the anticipated traffic and associated costs to ensure alignment with your budget and usage expectations.

... see more

Remediation​

Open File

Remediation​

From Command Line​

Associate an AWS WAF Web ACL with an API Gateway API Stage​

Associate an AWS WAF Web ACL with an API Gateway stage by running the associate-web-acl command:

aws wafv2 associate-web-acl \
--web-acl-arn  {{web-acl-arn}} \
--resource-arn {{api-gateway-stage-arn}}

Replace {{web-acl-arn}} with the ARN of your Web ACL and {{api-gateway-stage-arn}} with the ARN of your API Gateway stage.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 16a vulnerability and threat management;1010no data
💼 APRA CPG 234 → 💼 36g vulnerability management controls — which identify and address information security vulnerabilities in a timely manner;1010no data
💼 APRA CPG 234 → 💼 39a implement mechanisms that access and analyse timely threat intelligence regarding vulnerabilities, threats, methods of attack and countermeasures;1010no data
💼 APRA CPG 234 → 💼 39d implement mechanisms to disrupt the various phases of an attack. Example phases include reconnaissance, vulnerability exploitation, malware installation, privilege escalation, and unauthorised access1010no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [APIGateway.4] API Gateway should be associated with a WAF Web ACL11no data
💼 Cloudaware Framework → 💼 Threat Protection31no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1163no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)63no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3763no data
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet3638no data