Public API Gateway REST API has an authorizer

Check ID: apigateway_restapi_public_with_authorizer
Provider: AWS
Service: apigateway
Severity: MEDIUM
Categories: internet-exposed, identity-access
Resource type: AwsApiGatewayRestApi

What this check verifies

API Gateway REST APIs exposed to the Internet are evaluated for an attached authorizer that enforces caller identity (Lambda authorizer or Cognito user pool) on method invocations. Focus is on whether public endpoints require authenticated requests rather than accepting anonymous calls.

Risk

Without an authorizer on a public API, anonymous callers can:

Read or alter data (confidentiality/integrity)
Trigger backend actions, impacting systems
Abuse traffic, degrading availability and inflating costs

Endpoint enumeration also enables broader discovery and lateral movement.

Recommendation

Enforce authentication on all Internet-facing APIs by attaching an authorizer (Cognito user pool or Lambda) that validates tokens and scopes. Apply defense in depth:

Restrictive resource policies and IP controls
WAF, throttling, quotas, rate limits
Least-privilege backend access and comprehensive logging

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws apigateway create-authorizer —rest-api-id <rest_api_id> —name <example_resource_name> —type TOKEN —authorizer-uri arn:aws:apigateway:<region>:lambda:path/2015-03-31/functions/arn:aws:lambda:<region>:<account-id>:function:<example_resource_name>/invocations —identity-source ‘method.request.header.Authorization’

# Terraform: Minimal Lambda TOKEN authorizer for API Gateway REST API
resource "aws_api_gateway_authorizer" "<example_resource_name>" {
  name            = "<example_resource_name>"
  rest_api_id     = "<example_resource_id>"
  type            = "TOKEN"  # Critical: enables a Lambda authorizer on the REST API
  identity_source = "method.request.header.Authorization"  # Critical: header to read token
  authorizer_uri  = "arn:aws:apigateway:<region>:lambda:path/2015-03-31/functions/arn:aws:lambda:<region>:<account-id>:function/<example_resource_name>/invocations"  # Critical: Lambda authorizer function URI
}

# CloudFormation: Create a minimal Lambda TOKEN authorizer for a public REST API
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Authorizer
    Properties:
      Name: <example_resource_name>
      RestApiId: <example_resource_id>
      Type: TOKEN  # Critical: adds an authorizer to the REST API
      IdentitySource: method.request.header.Authorization  # Critical: header to read token from
      AuthorizerUri: arn:aws:apigateway:<region>:lambda:path/2015-03-31/functions/arn:aws:lambda:<region>:<account-id>:function/<example_resource_name>/invocations  # Critical: Lambda authorizer function URI

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_public_with_authorizer. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway REST API endpoint is private API Gateway REST API stage has X-Ray tracing enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires