All checks
Medium
API Gateway routes should specify an authorization type
Checks that the HTTP or WebSocket API route has an authorization type, so only authorized users or processes can call it. Only the field's presence is read, so a route set to NONE, which allows open access, passes here although AWS's control fails it.
- service
- APIGateway
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: Once the route needs authorization, callers that do not send a valid token or a SigV4-signed request are refused.
In the console
API Gateway → APIs → the HTTP API → Authorization → the route
- Authorizer
- A JWT or Lambda authorizer, or IAM (AWS_IAM); for a WebSocket API, on the $connect route
- Stage deployment
- Deploy the API, unless the stage deploys automatically
With the AWS CLI
aws apigatewayv2 update-route --api-id <api-id> --route-id <route-id> --authorization-type AWS_IAMWith Terraform
resource "aws_apigatewayv2_route" "this" {
api_id = var.api_id
route_key = var.route_key
target = var.route_target
authorization_type = "AWS_IAM"
}See which of your accounts this check is failing on.
Book a live scan