Back to All Checks
Medium APIGateway Regional

API Gateway V2 integrations should use HTTPS for private connections

Description

Flags API Gateway V2 (HTTP and WebSocket) integrations whose private VPC link connections do not have a TLS configuration. Without TLS, traffic between the API Gateway and the private backend is unencrypted and exposed to network-level interception inside the VPC.

Remediation

Configure TLS on every API Gateway V2 integration that uses a private VPC link so that traffic to the backend is encrypted in transit.

Steps

  1. Open the API Gateway console and select the affected HTTP or WebSocket API.
  2. Choose Integrations and edit the integration that uses a VPC link.
  3. Under TLS configuration, set the server name to verify so the integration uses HTTPS.
  4. Save the integration and redeploy the API stage.
Start Your Free Security Check