API Gateway V2 API has an authorizer configured

Check ID: apigatewayv2_api_authorizers_enabled
Provider: AWS
Service: apigatewayv2
Severity: MEDIUM
Categories: identity-access
Resource type: AwsApiGatewayV2Api

What this check verifies

API Gateway v2 APIs use authorizers (JWT/Cognito or Lambda) to authenticate requests. This evaluates whether an API has an authorizer configured to control access to its routes.

Risk

Without an authorizer, anyone can invoke routes.

Confidentiality: exposure of data and metadata
Integrity: unauthorized state changes or actions
Availability/Cost: automated abuse of backends, traffic spikes, and unexpected spend

Recommendation

Enable an authorizer (JWT/Cognito or Lambda) so only authenticated principals can invoke routes.

Enforce least privilege with scopes/claims or policy decisions
Apply defense in depth with resource policies, throttling, and WAF
Avoid public routes unless explicitly required

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws apigatewayv2 create-authorizer —api-id <API_ID> —authorizer-type REQUEST —name <example_resource_name> —authorizer-uri arn:aws:apigateway:<REGION>:lambda:path/2015-03-31/functions/<LAMBDA_FUNCTION_ARN>/invocations —identity-source ‘$request.header.Authorization’

# Minimal AWS API Gateway v2 Lambda authorizer
resource "aws_apigatewayv2_authorizer" "<example_resource_name>" {
  api_id           = "<example_resource_id>"
  name             = "<example_resource_name>"
  authorizer_type  = "REQUEST"  # Critical: creates a Lambda REQUEST authorizer
  authorizer_uri   = "arn:aws:apigateway:<REGION>:lambda:path/2015-03-31/functions/<LAMBDA_FUNCTION_ARN>/invocations"  # Critical: Lambda to invoke
  identity_sources = ["$request.header.Authorization"]  # Critical: identity source for authorization
}

# CloudFormation: create a minimal Lambda authorizer for API Gateway v2
Resources:
  <example_resource_name>:
    Type: AWS::ApiGatewayV2::Authorizer
    Properties:
      ApiId: <example_resource_id>
      AuthorizerType: REQUEST  # Critical: enables a Lambda REQUEST authorizer on the API
      AuthorizerUri: arn:aws:apigateway:<REGION>:lambda:path/2015-03-31/functions/<LAMBDA_FUNCTION_ARN>/invocations  # Critical: Lambda authorizer function to invoke
      IdentitySource:  # Critical: where to read the auth token from
        - "$request.header.Authorization"
      Name: <example_resource_name>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigatewayv2_api_authorizers_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway V2 API stage has access logging enabled AppStream fleet has default internet access disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires