Check ID: apigateway_restapi_public
Provider: AWS
Service: apigateway
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsApiGatewayRestApi

What this check verifies

Amazon API Gateway REST APIs are evaluated for endpoint exposure: internet-accessible endpoints versus private VPC-only access via interface VPC endpoints (AWS PrivateLink).

Risk

Internet exposure increases attack surface:
  • Confidentiality: misconfigured or anonymous methods can leak data
  • Integrity: unauthorized calls can change backend state
  • Availability/cost: bots or DDoS can exhaust capacity and spike spend

Recommendation

Prefer private REST APIs reachable via interface VPC endpoints (PRIVATE). If public access is required, apply least privilege and defense in depth:
  • Restrict with resource policies (aws:SourceVpc/aws:SourceVpce)
  • Enforce strong auth (IAM, Cognito, or authorizers)
  • Add AWS WAF, throttling, usage plans, and comprehensive logging

Remediation

aws apigateway update-rest-api --rest-api-id <REST_API_ID> --patch-operations op=replace,path=/endpointConfiguration/types/0,value=PRIVATE

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_public. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks