AWS AppSync GraphQL API does not use API key authentication

Check ID: appsync_graphql_api_no_api_key_authentication
Provider: AWS
Service: appsync
Severity: HIGH
Categories: identity-access
Resource type: AwsAppSyncGraphQLApi

What this check verifies

AWS AppSync GraphQL APIs are examined for the default authorization type. The finding indicates an API configured with API_KEY instead of IAM, Cognito, OIDC, or Lambda authorizers.

Risk

Static API keys can be leaked or reused, enabling unauthorized queries and mutations.

Confidentiality: unrestricted data reads
Integrity: unauthorized writes and schema misuse
Accountability: no user identity for auditing, difficult revocation and scoping

Recommendation

Replace API_KEY with stronger modes and apply least privilege:

AWS_IAM for service-to-service
Cognito User Pools or OIDC for end users
Lambda authorizer for custom logic If guest access is unavoidable, limit to read-only fields, enforce throttling, use short key lifetimes, and apply schema-level authorization.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws appsync update-graphql-api —api-id <api-id> —name <api-name> —authentication-type AWS_IAM

# AppSync GraphQL API with non-API key auth
resource "aws_appsync_graphql_api" "<example_resource_name>" {
  name                = "<example_resource_name>"
  authentication_type = "AWS_IAM"  # Critical: avoids API_KEY default auth
}

# CloudFormation: set default auth to non-API key
Resources:
  <example_resource_name>:
    Type: AWS::AppSync::GraphQLApi
    Properties:
      Name: <example_resource_name>
      AuthenticationType: AWS_IAM  # Critical: switches default auth away from API_KEY

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = appsync_graphql_api_no_api_key_authentication. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS AppSync API has field-level logging set to ALL or ERROR Athena workgroup encrypts query results in S3

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires