API Gateway REST API stage cache data is encrypted at rest

Check ID: apigateway_restapi_cache_encrypted
Provider: AWS
Service: apigateway
Severity: MEDIUM
Categories: encryption
Resource type: AwsApiGatewayStage

What this check verifies

API Gateway REST API stages with caching have cache data encrypted at rest. The evaluation targets stages where caching is enabled and verifies that stored responses are protected via the Encrypt cache data setting.

Risk

Unencrypted cache contents can expose response payloads, tokens, or PII if cache storage, backups, or admin tooling are accessed outside normal controls, harming confidentiality and enabling replay or session hijacking. Disclosure also reveals API patterns, aiding lateral movement and targeted abuse.

Recommendation

Enable encryption at rest for any cached stage (Encrypt cache data).
Apply least privilege to stage administration and cache invalidation.
Avoid caching sensitive endpoints; use short TTLs and scheduled cache flushes for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws apigateway update-stage --rest-api-id <restapi-id> --stage-name <stage-name> --patch-operations op=replace,path=/*/*/caching/dataEncrypted,value=true

# Enable encryption for all cached methods in the stage
resource "aws_api_gateway_stage" "<example_resource_name>" {
  rest_api_id   = "<example_resource_id>"
  stage_name    = "<example_resource_name>"
  deployment_id = "<example_resource_id>"

  method_settings {
    resource_path        = "/*"
    http_method          = "*"
    cache_data_encrypted = true  # Critical: encrypt cached responses at rest
  }
}

# CloudFormation: enable encryption for all cached methods in a stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: <example_resource_name>
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      MethodSettings:
        - ResourcePath: /*
          HttpMethod: "*"
          CacheDataEncrypted: true  # Critical: encrypt cached responses at rest for all methods

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_cache_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway REST API has an authorizer on all methods API Gateway REST API stage has client certificate enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires