All checks
Medium
API Gateway V2 integrations should use HTTPS for private connections
Flags API Gateway V2 (HTTP and WebSocket) integrations whose private VPC link connections do not have a TLS configuration. Without TLS, traffic between the API Gateway and the private backend is unencrypted and exposed to network-level interception inside the VPC.
- service
- APIGateway
- severity
- Medium
- scope
- evaluated in every region
How to fix it
Configure TLS on every API Gateway V2 integration that uses a private VPC link so that traffic to the backend is encrypted in transit.
- Open the API Gateway console and select the affected HTTP or WebSocket API.
- Choose Integrations and edit the integration that uses a VPC link.
- Under TLS configuration, set the server name to verify so the integration uses HTTPS.
- Save the integration and redeploy the API stage.
See which of your accounts this check is failing on.
Book a demo