API Gateway REST API stage has client certificate enabled

Check ID: apigateway_restapi_client_certificate_enabled
Provider: AWS
Service: apigateway
Severity: MEDIUM
Categories: encryption
Resource type: AwsApiGatewayStage

What this check verifies

API Gateway stage has a client certificate configured so HTTP/S integrations can perform mutual TLS and authenticate API Gateway to the backend

Risk

Without client authentication to the backend, requests cannot be proven to originate from API Gateway. Direct calls to the backend may bypass gateway policies, enabling unauthorized access and data tampering. This degrades integrity and confidentiality and reduces auditability.

Recommendation

Enable mutual TLS from API Gateway to the backend with a client certificate, and configure the backend to trust only that identity. Apply zero trust and least privilege: block public access to the backend, restrict networks, rotate certificates, and monitor authentication failures.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws apigateway update-stage --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME> --patch-operations op=replace,path=/clientCertificateId,value=<CLIENT_CERT_ID>

# Terraform: attach a client certificate to a REST API stage
resource "aws_api_gateway_client_certificate" "example" {}

resource "aws_api_gateway_stage" "<example_resource_name>" {
  stage_name          = "<example_resource_name>"
  rest_api_id         = "<example_resource_id>"
  deployment_id       = "<example_resource_id>"
  client_certificate_id = aws_api_gateway_client_certificate.example.id  # Critical: enables client certificate on the stage
}

# CloudFormation: attach a client certificate to a REST API stage
Resources:
  ClientCert:
    Type: AWS::ApiGateway::ClientCertificate

  ApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: <example_resource_name>
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      ClientCertificateId: !Ref ClientCert  # Critical: enables client certificate on the stage

References

https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_client_certificate_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway REST API stage cache data is encrypted at rest API Gateway REST API stage has logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires