API Gateway stage has a WAF Web ACL attached

Check ID: apigateway_restapi_waf_acl_attached
Provider: AWS
Service: apigateway
Severity: MEDIUM
Resource type: AwsApiGatewayStage

What this check verifies

Amazon API Gateway (REST API) stages are assessed for an associated AWS WAF web ACL. The finding reflects whether a web ACL is linked at the stage level.

Risk

Absent a WAF web ACL, APIs are exposed to application-layer threats that impact CIA:

Confidentiality: data exfiltration via injection
Integrity: parameter tampering and path traversal
Availability: L7 floods, bot abuse, resource exhaustion Public endpoints face heightened risk.

Recommendation

Attach an AWS WAF web ACL to each exposed stage and apply defense in depth:

Use managed rule groups and tailored allow/deny lists
Apply rate limiting to throttle abuse
Enforce least-privilege network exposure
Continuously tune rules using logs and metrics Validate changes to reduce false positives.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws wafv2 associate-web-acl --web-acl-arn <WEB_ACL_ARN> --resource-arn arn:aws:apigateway:<REGION>::/restapis/<REST_API_ID>/stages/<STAGE_NAME>

# Attach a WAFv2 Web ACL to an API Gateway REST API stage
resource "aws_wafv2_web_acl_association" "<example_resource_name>" {
  resource_arn = "arn:aws:apigateway:<example_region>::/restapis/<example_resource_id>/stages/<example_stage_name>" # CRITICAL: target API Gateway stage
  web_acl_arn  = "<example_resource_arn>" # CRITICAL: Web ACL to attach
}

# CloudFormation: Attach a WAFv2 Web ACL to an API Gateway REST API stage
Resources:
  <example_resource_name>:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: arn:aws:apigateway:<example_region>::/restapis/<example_resource_id>/stages/<example_stage_name>  # CRITICAL: target API Gateway stage
      WebACLArn: <example_resource_arn>  # CRITICAL: Web ACL to attach

References

https://docs.aws.amazon.com/apigateway/latest/developerguide/security-monitoring.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_waf_acl_attached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway REST API stage has X-Ray tracing enabled API Gateway V2 API stage has access logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires