Skip to main content

🛡️ AWS API Gateway REST API Stage is not associated with a WAF Web ACL🟢

Logic​

Similar Policies​

  • Internal: dec-x-bfdadcc4

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-bfdadcc41

Description​

Open File

Description​

Associate AWS API Gateway REST API stages with a WAF Web ACL to provide enhanced security against web application threats. AWS WAF is a web application firewall designed to block, allow, or count web requests based on customizable rules and security conditions that you define. Linking your API Gateway stage with an AWS WAF Web ACL helps safeguard your APIs from common exploits, such as SQL injection and cross-site scripting (XSS), and other malicious activities targeting your APIs.

Rationale​

Configuring AWS WAF Web ACLs for API Gateway stages improves overall security posture by implementing rule-based traffic filtering. This measure defends against automated attacks, unauthorized access, and other malicious web activities. It also enables security teams to monitor and audit traffic patterns, allowing proactive adjustments to security configurations. Without a WAF Web ACL in place, APIs are vulnerable to various attack vectors, which could lead to unauthorized access, data breaches, and disruption of services.

... see more

Remediation​

Open File

Remediation​

From Command Line​

Associate an AWS WAF Web ACL with an API Gateway API Stage​

You can link an AWS WAF Web ACL to an API Gateway Stage by running the associate-web-acl command:

aws wafv2 associate-web-acl \
--web-acl-arn  {{web-acl-arn}} \
--resource-arn {{api-gateway-stage-arn}}

Replace {{web-acl-arn}} with the ARN of your Web ACL and {{api-gateway-stage-arn}} with the ARN of your API Gateway Stage.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 16a vulnerability and threat management;1010no data
💼 APRA CPG 234 → 💼 36g vulnerability management controls — which identify and address information security vulnerabilities in a timely manner;1010no data
💼 APRA CPG 234 → 💼 39a implement mechanisms that access and analyse timely threat intelligence regarding vulnerabilities, threats, methods of attack and countermeasures;1010no data
💼 APRA CPG 234 → 💼 39d implement mechanisms to disrupt the various phases of an attack. Example phases include reconnaissance, vulnerability exploitation, malware installation, privilege escalation, and unauthorised access1010no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [APIGateway.4] API Gateway should be associated with a WAF Web ACL11no data
💼 Cloudaware Framework → 💼 Threat Protection31no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1148no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)48no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3748no data
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet3638no data