Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
apigateway_restapi_publicProvider: AWS
Service:
apigatewaySeverity: MEDIUM
Categories:
internet-exposedResource type:
AwsApiGatewayRestApiWhat this check verifies
Amazon API Gateway REST APIs are evaluated for endpoint exposure: internet-accessible endpoints versus private VPC-only access via interface VPC endpoints (AWS PrivateLink).
Risk
Internet exposure increases attack surface:- Confidentiality: misconfigured or anonymous methods can leak data
- Integrity: unauthorized calls can change backend state
- Availability/cost: bots or DDoS can exhaust capacity and spike spend
Recommendation
Prefer private REST APIs reachable via interface VPC endpoints (PRIVATE).
If public access is required, apply least privilege and defense in depth:
- Restrict with resource policies (
aws:SourceVpc/aws:SourceVpce) - Enforce strong auth (IAM, Cognito, or authorizers)
- Add AWS WAF, throttling, usage plans, and comprehensive logging
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html
- https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html#apigateway-resource-policies-source-vpc-example
- https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html
- https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = apigateway_restapi_public. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks