Check ID: apigateway_restapi_authorizers_enabled
Provider: AWS
Service: apigateway
Severity: MEDIUM
Categories: identity-access
Resource type: AwsApiGatewayRestApi

​
What this check verifies

API Gateway REST APIs are evaluated for access control: an API-level authorizer is present, or all resource methods use an authorization mechanism. Methods marked NONE indicate unauthenticated access.

​
Risk

Unauthenticated API methods enable:
  • Arbitrary reads exposing data (confidentiality)
  • Unauthorized actions against backends (integrity)
  • Abuse and high traffic causing cost spikes or outages (availability)
Attackers can enumerate endpoints and invoke integrations without tokens.

​
Recommendation

Require authentication on every method: use Cognito user pools, Lambda authorizers, or IAM; avoid NONE.
  • Enforce least privilege with scoped policies
  • Use private endpoints or resource policies for internal APIs
  • Add rate limiting and WAF for defense in depth

​
Remediation

# Terraform: set method authorization so it's not public
resource "aws_api_gateway_method" "<example_resource_name>" {
  rest_api_id  = "<example_resource_id>"
  resource_id  = "<example_resource_id>"
  http_method  = "GET"
  authorization = "AWS_IAM" # Critical: authorizes the method (not NONE)
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_authorizers_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks